Welcome to Pinpoint: policy-controlled MCP dataflow

[CodePalAI]

Welcome to Pinpoint

Pinpoint is an open-source policy gateway for sensitive MCP data. It lets an AI agent act on structured business data while an operator-controlled gateway keeps selected values out of the model-facing MCP transcript.

Who should evaluate it

• CISOs and security directors defining acceptable AI data paths
• CTOs, VPs of Engineering, and AI platform leaders standardizing MCP controls
• Data governance and compliance engineers who need machine-verifiable execution evidence
• MCP and API platform teams supporting more than one agent host

Start with one bounded workflow

Choose a synthetic or sanitized source tool, one destination tool, the smallest required field projection, and explicit item and byte limits. Encode that authority in a versioned flow policy, run the no-model protocol gate, inspect the signed receipt, and scan the client event stream before considering a controlled workload.

The README includes the enterprise evaluation path, policy example, deployment fit, evidence, and security boundary:

• https://github.com/CodePalAI/pinpoint#evaluate-with-your-team
• https://github.com/CodePalAI/pinpoint#evidence
• https://github.com/CodePalAI/pinpoint#security-boundary

Current evidence

• Claude Code and GitHub Copilot CLI both completed the committed hidden-destination flow.
• The protocol gate completed 30/30 exact destinations and denied 7/7 bypass attempts.
• The committed client grades found zero occurrences across 800 exact fixture-canary checks.

These are first-party synthetic results, not customer production evidence, a formal noninterference proof, or a compliance certification. Tool names, field names, counts, sizes, timing, limits, and success remain visible. The wrapped MCP process is trusted with the values.

Design partners and independent review

We want to work with AI platform and security teams that have one concrete source-to-destination MCP workflow and can evaluate it without posting confidential data. Useful public feedback includes policy ergonomics, host compatibility, protocol failures, metadata concerns, and independently reproduced synthetic receipts.

Do not post real records, credentials, private prompts, raw tool output, or production flow policies. Use GitHub private vulnerability reporting for security issues. For an architecture conversation, describe the systems and required fields in sanitized terms.

Technical claim and threat model: https://github.com/CodePalAI/pinpoint/blob/main/planning/value_opaque_mcp_dataflow.md

Private vulnerability reporting: https://github.com/CodePalAI/pinpoint/security/advisories/new

Evidence added after launch of this discussion

• Spin 6.5.2 explored 945,468 states and 1,381,379 transitions with zero assertion violations; a deliberate late-output leak mutation was detected.
• A standalone verifier accepts the committed signed receipt and rejects tampered or wrong-key receipts without importing the Pinpoint runtime.
• Unmodified @modelcontextprotocol/server-filesystem@2026.7.10 passed the pinned result-firewall/query gate; 999 unrelated synthetic email canaries stayed absent.
• The flow policy now supports operator-fixed fixedWhere predicates that the model cannot omit or override.

Independent proof remains open:

• Clean-machine reproduction: evidence: independent opaque-flow reproduction on a clean machine #14
• Unaffiliated security review: security: independent review of opaque-flow confinement and receipts #15

Breakthrough proof gates

Pinpoint now has a bounded Spin model, mutation sensitivity, fixed operator predicates, a standalone receipt verifier, and one pinned unmodified OSS server gate. That closes the locally executable evidence program, not independent proof.

Blocking external gates are public:

• Independent clean-machine reproduction: evidence: independent opaque-flow reproduction on a clean machine #14
• Unaffiliated security review: security: independent review of opaque-flow confinement and receipts #15
• Comparative private-composition evaluation: evidence: comparative evaluation against one private-composition alternative #16
• Externally sourced workflow and retention demand: evidence: externally sourced bounded MCP workflows and retention demand #17
• Broader independent host/server interoperability: evidence: broader independent MCP host and server interoperability #18

Strict scorecard: https://github.com/CodePalAI/pinpoint/blob/main/planning/breakthrough_scorecard.md