TrustGate MCP — AI Content Firewall

TrustGate MCP screens untrusted text, HTML, and public webpages before an AI tutor, research assistant, browser agent, or other automated system places that content in its working context. It detects high-confidence prompt-injection patterns, attempts to expose credentials, tool-manipulation instructions, suspicious encodings, invisible Unicode controls, and instructions hidden in HTML.

The service is deliberately small for v0.1. It exposes one focused MCP tool, screen_untrusted_content, with strict JSON input and output schemas. The response includes verdict, risk_score, threats, safe_text, recommended_action, confidence, analysis_method, and transparent execution and billing metadata.

Why use TrustGate

Webpages, uploaded study notes, emails, and documents can contain instructions aimed at the AI system rather than the human reader. TrustGate gives an agent a consistent checkpoint before it uses that material. It is useful for AI tutoring, student research, retrieval-augmented generation, browser automation, support assistants, and any workflow that reads content the developer does not fully control.

TrustGate is a defense-in-depth signal. An allow verdict reduces obvious risk but is not a guarantee of safety. Callers should still use least-privilege tools, require confirmation for consequential actions, and keep credentials out of model context.

How it works

1. The caller provides exactly one of text, html, or url and can optionally describe agent_intent.
2. Fast deterministic rules run first. HTML is reduced to visible text while suspicious hidden elements are recorded. Public URL fetching blocks private and local destinations, checks redirects, limits response sizes, and accepts text-like content only.
3. Ambiguous content can use an optional semantic classifier when OPENAI_API_KEY is configured. Clear benign and clear malicious inputs avoid that cost.
4. The tool returns a strict structured result. Provider failures degrade to deterministic analysis without returning secret or provider details.

MCP connection

This Actor runs in Apify Standby mode. Authenticated MCP clients connect to the Actor's /mcp endpoint using Streamable HTTP. The root route is a free readiness check and does not invoke the tool or create a billable event. Apify's Standby edge requires the caller's own Apify bearer token; no creator-owned token is embedded in the service. A public OAuth plugin should place a user-controlled gateway in front of this endpoint so OAuth discovery and domain verification remain readable before authentication.

The tool is marked as non-read-only because each successful call records a pay-per-event billing event. It is also marked open-world because URL scans fetch a public external resource. A successful scan charges exactly one trustgate-result event. Invalid input, a blocked billing limit, and the default health check do not create a successful scan event.

Inputs

• text: plain untrusted content, up to 200,000 characters.
• html: HTML content, up to 500,000 characters.
• url: one public HTTP or HTTPS URL returning text, HTML, or JSON.
• agent_intent: optional description of the agent's legitimate task.
• semantic_fallback: use semantic classification only for ambiguous content when configured.
• include_safe_text: include a sanitized content copy in the response.

Never submit passwords, API keys, access tokens, private student records, or other secrets.

Privacy and security

TrustGate does not intentionally log submitted content, authorization headers, or secrets. MCP results are returned directly to the caller rather than written to the default dataset. Operational metadata is logged without source text. When semantic fallback is enabled and used, the analyzed content and supplied intent are sent to the configured OpenAI API model. Apify and any configured AI provider process data under their own platform terms.

Ordinary Actor run

Running the Actor outside Standby with empty input produces one zero-cost health result in the default dataset and exits. This makes the default console run safe and predictable.

Local verification

Install requirements.txt, add the project and dependencies to Python's import path, and run:

python -m unittest discover -s tests -v

No API key is required for deterministic tests.