Drex Agent Firewall

Drex Agent Firewall places policy evaluation and guarded execution between AI agents and supported consequential actions.

Actions routed through supported firewall interfaces are normalized into structured action envelopes, evaluated through Drex where configured, checked against deterministic policy, and enforced before execution.

What it can mediate

Supported integrations include:

• MCP tool execution
• Shell commands
• Filesystem operations
• Git operations
• GitHub actions
• HTTP/network actions
• Secret and credential handling on supported paths
• Agent-action audit recording

Policy outcomes can allow, constrain, escalate, abstain, or block actions according to the configured policy and supported execution path.

Why use it

Drex Agent Firewall is designed for developers running AI agents that can interact with consequential systems.

Example uses include:

• Blocking destructive shell commands
• Protecting sensitive filesystem paths
• Controlling repository writes
• Restricting Git and GitHub operations
• Controlling outbound HTTP/network activity
• Preventing supported secret-exfiltration paths
• Mediating MCP tool calls
• Creating local audit records for guarded actions

Integration model

The firewall supports a stdio MCP proxy, a direct guarded MCP server, and library adapters for supported action classes.

Actions routed through these supported interfaces can be evaluated and enforced before execution.

Drex classification is optional where supported. Local replay operation does not require live Drex API access. Live Drex classification requires separately authorized Drex credentials and network access.

Security boundary

Drex Agent Firewall is an enforcement layer for supported integrated paths.

It is not a replacement for operating-system permissions, containers, sandboxes, microVMs, credential systems, or full host isolation.

Native actions that bypass the firewall's supported MCP or guarded adapter paths are outside its mediation boundary.

Optional sandboxing is host-dependent and does not establish complete host mediation.

Local SQLite/WAL audit records can be modified by a local process with equivalent operating-system permissions.

Boundary	Status
MCP mediation	PASS
Supported adapter mediation (shell, filesystem, Git, GitHub, HTTP)	PASS
Native host mediation	NOT SUPPORTED
Sandbox containment	PARTIAL (host-dependent)
Audit tamper resistance	PARTIAL

Requirements

• Python 3.10+
• Compatible MCP stdio client/server setup for MCP use
• Appropriate OS/tool access for enabled adapters
• Drex API credentials only if live Drex classification is enabled
• Network access only for features that require it

Release verification (v0.1.4)

• Final shipped test suite: 225 passed
• GitHub host-security CI: 225 passed, 0 skipped
• OCI security suite: 34 passed
• Local targeted host/security suite: 101 passed
• MCP/adapter/policy targeted suite: 43 passed
• MCP initialize and tools/list: PASS
• Verified MCP canary: safe routed action ALLOW (executed once); destructive routed action BLOCK (executed zero times); audit records created
• Commercial package: 157 files, no live credentials or private deployment data

Test results describe the verified release build; they are not a guarantee against every possible bypass or vulnerability.

License

Drex Agent Firewall Commercial License (proprietary). Version 0.1.4 is not open source. Published by ELYRAON.