Model Intent Protocol — Data skill for Claude Code
MIP: a verified layer on top of MCP that only lets data reach destinations the user named.
How to install Model Intent Protocol
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open mdayan8/model-intent-protocol and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Model Intent Protocol does
MIP: a verified layer on top of MCP that only lets data reach destinations the user named. Benchmarked on AgentDojo and MCPMark.
Alternatives in Data
- Private GPT — Complete API layer for private AI applications on local models: RAG, skills, tools, MCP, text-to-sql, and more 57.5k ★
- Context Mode — Benchmark Results — Benchmarked against real outputs from popular Claude Code MCP servers, Skills, and dev tools 5.6k ★
- 12 Services Layer — Prompt 12: Wire Up Services Layer (Analytics, Policy, Settings, Sessions) 2.3k ★
README
MIP: Model Intent Protocol
MCP tells the model what it can do. MIP makes sure it only does what you meant.
MIP is a layer that sits on top of [MCP](https://modelcontextprotocol.io). Your agent and your MCP servers stay as they are. Every tool call that would send data somewhere passes through a small kernel first. The kernel allows the call only if the destination was named by the user, so a prompt injection cannot redirect your data to an attacker. The kernel is proven in Lean, ported to Rust, and the two agree on 2,000,000 random cases.
**Status: research prototype.** Everything below is measured and reproducible from this repo, including the parts where MIP does worse than plain tool calling.
Results at a glance
| What was measured | Classic tool calling | MIP | Where |
|---|---|---|---|
| Tool-definition tokens for 10 popular MCP servers (132 tools) | 31,944 | 81 typical, 147 worst case | tokens |
| Tool-definition tokens through the gateway, 4 real servers (40 tools) | 4,539 | 533 | gateway |
| Data-theft attacks that succeed when the model is fully hijacked (488 AgentDojo cases) | 466 (95.5%) | 6 (1.2%) | hijacked agent |
| AgentDojo tasks completed, no attack (97 tasks, Claude Haiku 5.5) | 80.4% | 69.1% (Fence, directory) | AgentDojo |
| AgentDojo attacks that succeeded, real model (949 cases) | 1.9% | 1.9% | AgentDojo |
| MCPMark filesystem runs passed (40 tasks × 3 trials) | 71.7% | 66.7%, within noise | MCPMark |
| MCPMark cost for the 120 runs | $6.13 | $3.01 | MCPMark |
| Gateway latency added per tool call (median) | 0.31 ms read, 0.55 ms write | gateway | |
| Kernel decision time (Rust, Apple M2) | 0.21 to 1.02 µs | [kernel](#6-the-kernel-proofs-and-differential- |
Related Skills
Change Heavy
Heavy-mode 6-stage pipeline for changes that meet the project's CLAUDE.md Heavy-rigor trigger — its named high
Refresh Recommender
Run on-demand GSC health scan for the user's site. Pulls 28-day vs 28-day GSC data, flags decaying pages, page
SAFactory Hive Mind
SAFactory is a meta-agent system that automatically generates perfect Single File Agents (SFAs) from real user
Lastfm Agent
AI agent that answers questions about the Last.fm global Top 50 in plain English: writes its own SQL on Snowfl
WYRD Protocol World Yielding Real Time Data AI World Model
The WYRD Protocol Architecture. The goal is to move the "World Model" out of the LLM's fleeting memory and int
AICreateAI
AICreateAI: Claude Code skill for AI-to-AI data generation and distillation - zero-trust verified samples, div
Related Agents
Outreach Enricher
Intent Outreach Phase-2 worker. Enriches one lead + its contacts via the deterministic enrich_lead MCP tool an
Intellij Debugger Maintainer
Fix issues, add features, and maintain quality in intellij-debugger. MCP server that lets Claude control Intel
03.5 Visual Asset Annotator
Identifies visual opportunities in content, generates data charts from verified research, optionally generates
