Our MCP flight recorder denied 3 of 12 agent calls, then braked in 10.54 ms

Agent Flight Recorder (sdfr) is our MCP gateway, built on the MCP TypeScript SDK. It sits between an agent and its MCP servers, checks every tool call against a deny-by-default YAML policy, and appends each decision to a hash-chained SQLite ledger. We ran a scripted 12-call session with no API keys: 7 calls allowed, 2 approved, 3 denied, and after we pulled the brake the next call came back blocked in 10.54 ms. The catch is that sdfr only governs calls that pass through it.

The catch

A call that goes around the proxy never reaches the policy or the ledger. If your agent also has a shell tool or its own HTTP client, sdfr records none of that traffic. Put it in front of every MCP server the agent can reach, and keep other egress closed.

The ledger is tamper-evident. Append-only triggers and the hash chain stop casual edits, but someone holding the database file can copy it, strip the triggers and rewrite a row. sdfr verify then fails at that sequence number, so you learn about the rewrite after it happens.

In the scripted session, a background loop auto-approves the two pending writes every 20 ms. In real use a person clicks Approve in the localhost timeline, and the default approval timeout is 120 seconds. The timeline's one-time token rides in the query string, which SECURITY.md lists as an accepted risk.

What we ran (keyless)

bun install --frozen-lockfile && bun run build
bun run sdfr -- keygen --home .sdfr
bun run scenario
bun run report

From reports/flight-recorder.json, run on October 13, 2026:

The three denied calls were the kind you never want an agent to send unattended: a form submit to tips.example.org, an email to example.org, and an account signup at evil.example. The scenario runs a local sandbox that stands in for the internet. It received 2 requests, the two submits to 127.0.0.1 and localhost that policy allows, and none of the three denied calls.

How it is wired

The agent talks stdio MCP to sdfr, which exposes each downstream tool as <server>__<tool>. Before forwarding, sdfr matches the call against the YAML rules (allow, deny, approve), with side-effect verbs like submit, send and create_account denied unless a rule allows them. Arguments are redacted, hashed into the chain over RFC 8785 canonical JSON, and written to SQLite. sdfr brake drops a lockfile that turns every new call into blocked_by_brake, and sdfr incident export signs a packet with Ed25519 for anyone reviewing the session later.

Minilab (open source)

SkilledDragonCorp/agent-flight-recorder is Apache-2.0 TypeScript. Its keyless e2e wraps morluto/rea (240,320 stars, MIT, TypeScript, as of October 14, 2026) to show sdfr proxying a large real MCP server. Clone it, run bun run report, and compare your reports/flight-recorder.json with the table above.

bun install --frozen-lockfile && bun run build && bun run scenario