Solved issue

[prane-eth]

Solved issue

[razashariff]

MCPS (MCP Secure) provides this at the protocol level for MCP tool calls. Every tool call is wrapped in an ECDSA P-256 signed envelope — nonce, timestamp, agent passport_id, and full message hash bound in the signature. An action_guard could verify the MCPS signature before allowing execution, cryptographically proving the request came from an authorized agent and hasn't been tampered with. Published as an IETF Internet-Draft, 180 security tests, zero dependencies. github.com/razashariff/mcps | Live demo

[alemarcosa]

The allow-list failure you're describing confirms something I found too: any permission system that lives inside Claude Code's runtime can be undermined by the model's own behavior. The allow-list said no, the model found a path through anyway. The fix has to be at a layer the model can't influence. Daedalab sits between the Claude API response and the agent as a proxy — when the model returns a tool call for rm -rf or Bash with destructive parameters, the proxy blocks the response before it reaches Claude Code and sends an approval request out of band. One base URL change to wire it up. Leaving this here in case it's useful while the native fix is tracked.