Open-source Rohan gateway isolates MCP tool arguments in RAM to curb context leaks

An open-source project named Rohan has drawn attention on Hacker News with a security gateway for the Model Context Protocol (MCP) that aims to keep sensitive tool-call data, such as API keys and database passwords, out of LLM context windows and inference logs. The code lives in the rohan-protocol/sdk repository on GitHub and ships on npm as @rohan-protocol/mcp. The project describes the current release as a public beta, version 0.6.0.

The leak it targets

MCP is the protocol that lets AI agents call external tools. According to the repository's README, transport encryption such as TLS only protects data while it is moving between systems. At the host boundary, the README argues, standard MCP tool calls are handled in cleartext, so credentials passed as arguments can flow into the conversation context and into inference logs, where they remain exposed to exfiltration and prompt-injection attacks. The problem class is familiar to anyone following agent security: whatever an agent sends to a tool, or receives back, becomes part of the model's visible context.

How the gateway works

Rohan runs as a standard MCP server over stdio and can be added to clients such as Claude Desktop, Cursor and Windsurf with a one-line npx command. Rather than forwarding raw arguments, it registers a single tool, rohan_zk_handshake, which the README says evaluates execution parameters in ephemeral RAM, generates a 32-byte cryptographic commitment summarising the call's intent, and anchors state transitions on the Midnight blockchain through a gasless relayer.

Two mechanisms do most of the defensive work described in the README. A content filter the project calls its semantic firewall inspects payloads before execution and strips out-of-bounds content, including invisible Unicode characters in the U+200B to U+200D and U+FEFF ranges that attackers use to smuggle hidden instructions. A memory-wiping routine then overwrites the buffers that held the private data with zero bytes, with the project claiming no disk writes and no swap-file exposure at any point.

The repository is structured as a monorepo: an MCP server package, the core commitment engine with its relayer client, browser hooks that isolate execution inside Web Workers to defend against malicious browser extensions, and smart contracts targeting Midnight. A published threat register also lists mitigations such as replacing long-lived server-sent-event connections with chunked, scale-to-zero HTTP streaming.

Status and caveats

Despite the zero-knowledge branding, the actual ZK component does not exist yet. The README states that client-side WASM ZK-SNARK proving circuits are still being researched, and that version 0.6.0 relies instead on RAM isolation, the firewall and memory zeroization. The cryptographic foundations are laid out in a paper the project says it published through Zenodo, but no independent security audit is mentioned anywhere in the documentation. The default client configuration also points at a hosted relayer operated by the project, so deployments trust that endpoint even though the code is MIT-licensed and can be self-hosted. In short, the security claims are the authors' own, and the gateway is early-stage.

Why it matters

MCP adoption is expanding quickly, and agents increasingly handle credentials, tokens and private data on every tool call. Very little in the protocol itself prevents those values from landing in a context window where an injection or a logged transcript can expose them. Whether or not Rohan's specific design holds up, and its unproven ZK ambitions plus blockchain dependency invite skepticism, it points at a real gap: the boundary between agent runtimes and their tools is becoming a security surface of its own. Gateway-style proxies, sandboxed argument handling and injection filtering look set to become standard fixtures of agent stacks, and early projects like this one are best treated as experiments worth studying rather than drop-in guarantees.