Soup Wall — AI skill for Claude Code

Soup Wall

A firewall for what an AI agent *does* — every tool call, tool result, MCP handshake and subagent spawn — that runs on one machine, needs no account, and makes no network call of its own.

Detection tells you content looks dangerous. This layer decides whether the *action* is allowed to happen: untrusted content driving a destructive command, a secret heading out over the network, a subagent asking for tools its parent never had, an MCP server quietly rewriting a tool description. It is deterministic, local, and shadow-first.

Pure Rust. Apache-2.0.

[](https://github.com/MakazhanAlpamys/soup-wall/actions/workflows/ci.yml) [](https://github.com/MakazhanAlpamys/soup-wall/actions/workflows/supply-chain.yml) 

What is in this repository

Crate	Purpose
core	Text detectors — prompt injection (signatures, heuristics, optional local classifier), secrets, PII, improper output — with OWASP LLM Top 10 and MITRE ATLAS tags, risk scoring, YAML policy
agent	The agent reference monitor: taint tracking, action classes, egress-host control, subagent authority, MCP manifest signals, first-match policy
agentfw	The daemon: Claude Code hook collector, MCP proxy with manifest pinning, local JSONL audit, replay, preflight, human approval grants, guarded execution
adapter	The versioned local decision contract a control plane would speak, if you add one
bench	Reproducible regression corpus and the policy-change gate

Not in this repository: the HTTP proxy for OpenAI/Anthropic traffic, SSO, SCIM, multi-tenant administration, usage ledgers and billing. Those are the commercial layer.

Quickstart

cargo build --release
./target/release/agentfw install        #