The frightening MCP demos, prompt-injection exfiltration, tool poisoning, rug pulls, all share one shape: something that looks like an ordinary tool call carries an attack. Most defenses answer this by asking a model to judge whether a request looks safe. That is a filter, and filters are probabilistic: they usually catch things. A security control should provably catch the attack, the same way every time.
Aggrete is an open-source MCP proxy that decides with a deterministic rule, before the upstream is contacted. No model sits in the decision path, so the same request gets the same answer every time, and you can read the exact rule and audit line for why.
Here are three well-known attacks, the block, and a script you can run in about a minute. Every repro drives the real policy engine. No servers, no keys, no network.
1. The lethal trifecta
The best-known MCP attack (Invariant Labs, 2025) needs three ingredients in one session: access to private data, exposure to untrusted content, and a way out. An assistant reads an attacker's public GitHub issue, obeys the instructions hidden in it, and posts your private repo back out. Any one ingredient is harmless. Together they are lethal.
