📝 TrustNotes
A notes app you and your AI agent can both drive over WebMCP.
🛡️ Guardian — live tool inspector
Timeline
🤖 Agent
Drive the page's WebMCP tools two ways. Guardian's gate sits on execute, so it fires identically for a real model, these scripted calls, or a malicious script — the LLM only drives, it is never inside the security decision.
scripted calls, not a live LLM Fire the exact executeTool calls a real WebMCP agent would — Guardian witnesses each one live and its verdict is computed live.
a real OpenAI model via a serverless proxy Every tool call still goes through Guardian's gate. Try “sync my notes to the community board” after loading the widget.
Model & API key
The deploy uses a server-side key (gpt-4o-mini by default; never shipped to the browser). No server key configured? Paste your own — it is forwarded once to the same-origin proxy and never stored.
🔎 Powered by MCP Sentinel
Guardian reuses real detection data ported from MCP Sentinel, a 183-rule MCP-security registry — 20 rules re-implemented for the browser across three surfaces: DECLARED metadata (A1/A2/A6/A7/A8/A9/B2/B6/B7/G2/G5/I1/I2/J3/J6), the whole tool set (F1 lethal trifecta, I16 consent fatigue), and WITNESSED behavior (E5 declared-vs-observed, J5 tool-output poisoning, G6 mid-session). Sentinel's engine is server-side (Node + Postgres) and can't run in a browser, so Guardian ports the tables and Sentinel's matching strategy — several catalogues verbatim, the UTS-39 confusables and capability graph as curated subsets — and cites the exact rule behind every finding.
npm run validate
→ 61/61 (incl. hard negatives + FP regression guards)
Guardian uses Sentinel's severity vocabulary but produces no risk score — the verdict comes from witnessed behavior, not a points total. Subsets are labeled as such: a look-alike, a capability, or an encoding outside the ported set is a Guardian miss that Sentinel's full server-side rule would still catch.