langchain-mcp-secure

langchain-mcps is a 5-layer progressive security framework for AI agents in LangChain that solves agent authorization through identity verification (v1.0 ECDSA passports), capability scoping (v2.0 implicit deny), tamper-proof audit logging (v2.1 merkle chains), time-bound permissions (v2.2 ephemeral access), and safe agent-to-agent delegation (v2.3 with protocol-level privilege escalation prevention via capability intersection). The core insight is that when Agent A delegates work to Agent B, the delegation token carries only the intersection of A's permissions and B's request—B cannot escalate beyond what A has, enforced cryptographically at the protocol level. Currently at v0.2.0 with all 5 layers implemented, 137 tests, and 90% coverage, it's open source (MIT) and ready for multi-agent systems where agents need to delegate work safely with full accountability.

General Observations on langchain-mcps:
Strengths:

Layered architecture is excellent — each layer answers one security question. This makes the system understandable and testable. You can enforce any level (v1.0 identity-only, or full v1.0-v2.3 stack).
Grounded in real patterns — not inventing security. You studied AWS, OAuth, SAML, K8s and adapted them intelligently. That's engineering maturity.
Protocol-level enforcement — privilege escalation prevention happens at the token level (capability intersection), not just in application logic. This is harder to bypass.
Rigorous testing — 137 tests with 90% coverage. The edge cases (replay attacks, escalation attempts, tampering) are explicitly tested. This builds real confidence.
Clean integration — MCPSCallbackHandler sits between LangChain and execution. No core changes needed, transparent to applications.
Scope discipline — v1.0-v2.3 is the MVP. v2.4/v2.5 are documented as issues, not premature optimizations. Ship now, scale later.
Considerations:

In-memory state — v2.3 uses in-memory nonce cache and quota pool. Fine for MVP, but document the single-process limitation clearly.
No async support yet — v2.2 has approval gates but they're sync. Noted as v2.5 future work.
Key management — the framework assumes agents have secure access to private keys. That's a separate problem (HSMs, key vaults) but worth documenting.
Performance — ECDSA signing/verification on every delegation. Not a bottleneck for typical agent systems, but worth profiling at scale.