01 / Architecture
One proxy between the agent and its tools.
The agent's MCP client talks to 127.0.0.1 instead of the server; the proxy screens, forwards and logs every call.
The path
Every call goes through 127.0.0.1
The agent's MCP client talks to the proxy instead of the server. The proxy screens each call, forwards what passes to the upstream server, and writes the decision to the local log either way.
AgentProxy Tools
What stays on the machine
Only a proof crosses the line
The prompt, the tool arguments, the operator's rules and every model score stay on the machine. A proof and its five public inputs leave it, and only when something downstream asks for one.
DecisionProverSolana verifier
02 / Four layers
Two layers that match, two that judge.
L0 and L1 are deterministic: the same payload always gets the same answer, so the proof can cover them. L2 and L3 are model-based; they run locally or in a TEE and are attested, not proven.
- L0RulesExact matches, allowlists and denylists over the raw payload: program ids, recipients, tool paths. Proven
- L1PatternsExpressions for override phrasing, prompt extraction, hidden unicode, role tags and exfiltration links. Proven
- L2SimilarityScores the redacted payload against known injections, from 0 to 1. Runs locally or in a TEE.Attested
- L3JudgeReads the redacted payload when L2 or a rule raises a doubt, and can clear an L2 flag. Runs locally or in a TEE.Attested
An example decision
03 / Redaction before the judge
The judge sees less than the agent sent.
Nothing sensitive leaves the machine: secrets and PII are redacted before the judge sees them, and the judge runs locally or inside a TEE whose attestation you can present on demand.
payloadHash
The canonical call as the agent sent it. L0 and L1 read this.
redactedHash
What L2 and L3 actually saw. The two hashes differ because something was removed.
04 / The attestation
One attestation, one action, one use.
An attestation starts from one screened decision and ends in one Solana instruction. Everything in between happens on the machine.
When something downstream needs proof — an escrow contract, a counterparty, an auditor — Blindseal produces a zero-knowledge attestation that a specific tool call passed a committed policy. The attestation binds to the action itself: target program, recipient, amount, policy root, and expiry are hashed into it, so it is worthless for any other call. It is single-use. The proof is generated locally and verified with one Solana instruction, so any program can gate agent actions without seeing the prompt, the arguments, the operator's rules, or which agent was screened.
The attestation in the figure
05 / What binds it
Hashed into the attestation.
The attestation binds to the action itself: target program, recipient, amount, policy root, and expiry are hashed into it, so it is worthless for any other call.
06 / The audit chain
A log that commits to itself.
Every decision is written to a hash-chained local log with selective disclosure: prove a time window was clean, or that a specific event occurred, without exposing traffic.
Hash-chained
Change one entry, break every hash after it
Each entry stores the hash of the one before it, its decision id, its payload hash and its verdict. Anyone holding the head can walk the chain back and recompute every link.
Selective disclosure
Show a window, not the traffic
A disclosure is a signed range of entries: the hashes and verdicts from the highlighted window, checkable against the head, with no payload in it.
07 / What we claim
A deliberately narrow claim.
One claim per call, and a plain line where it stops. The left column is what a verifier never learns; the right is all it gets.
What we claim
Blindseal proves that a specific call was screened under a committed policy by a specific detector version, and that the deterministic layers passed. The model-based layers run locally or in a TEE and are attested, not proven. Blindseal does not prove an agent is safe, and does not cover traffic that doesn't pass through the proxy.
| Hidden | Public |
|---|---|
| Prompt and tool arguments | That a valid attestation exists |
| Policy contents, thresholds, custom lists | Policy root (a hash) |
| Which agent / operator was screened | Detector version |
| Model-layer scores | Action hash, expiry, nullifier |
08 / Next
Check it yourself.
Paste an attestation into the verifier, or read how to point an agent at the proxy.