ERR_FLAKY
Tools are flaky
A tool call times out or errors mid-task, and the agent has no structured way to retry, fall back, or fail gracefully.
MCP-Native Trust Gateway
Outpost Gateway
Outpost is a self-hosted, open-source proxy that sits between your AI agent and the tools it calls, running entirely inside your own network. It validates tool-call contracts, pins tool definitions against tampering, and isolates failing tools — with an optional hosted control plane that only ever sees metadata, never your call payloads.
System Architecture
Where Outpost sits in your stack.
Outpost runs as a self-hosted proxy inside your own network, between your AI agent pipelines and the external tools or Model Context Protocol (MCP) servers they call. Only schema hashes, tool definitions, and aggregated statistics ever reach our hosted control plane — never your call arguments or results.
Prompt
AI Agents
CrewAI
LangGraph
AutoGen
Korneza Outpost
Schema-drift diff
Circuit breaker
Anomaly detection
Tool-def pinning
Structural Validator
Sub-millisecond schema checks on every tools/call
LLM Models
OpenAI
Claude
Gemini
MCP Servers
Slack
GitHub
DBs
The Problem
An agent is only as trustworthy as the tools it calls.
Every agent tool-call hands control to something outside your model: an API, a script, another service. Most of the time that’s fine. The failures that matter are the ones your agent can’t tell apart from a normal response.
DRIFT_SILENT
Tools drift silently
An upstream API changes its response shape with no warning. The agent keeps parsing the old shape and fails in ways that are hard to trace.
GARBAGE_OUT
Tools return garbage
A malformed or unexpected response reaches the model as if it were valid, and the agent acts on bad data with full confidence.
HOSTILE_INJECT
Tools get poisoned or rug-pulled
A tool's definition can carry instructions meant for the model, not the user — or get silently redefined into something dangerous after you've already vetted it. Without a hash to check against, neither is distinguishable from a legitimate tool.
Product · Outpost
One gateway. Three tiers of defense.
Outpost is a self-hosted, open-source MCP-native proxy that sits between your agent and its tools — deterministic reliability controls and security visibility that run entirely inside your network. An optional hosted control plane adds fleet-wide dashboards and tool-definition scanning from metadata alone; your tool-call arguments and results never leave your infrastructure.
00
Edge
Circuit-breaking and list-operation caching keep a flaky tool from taking your agent down with it — deterministic, fail-open, and running entirely on your own infrastructure.
- Circuit breaker: closed → open → half-open, trips on a configurable consecutive-failure threshold, with a cooldown before retry.
- In-process caching for tools/list and resources/read only — never tools/call, since the MCP spec excludes it from cacheable operations and a stale side effect is worse than a hard failure.
- Retries are a per-tool, off-by-default opt-in, never an automatic default — blindly retrying a side effect (a payment, an email) that already succeeded is not a safe general rule.
01
Structural
Every tool-call is checked against a registered contract and every tool definition is fingerprinted, so silent schema drift and 'rug pull' redefinitions get flagged instead of quietly breaking your agent.
- Synchronous, sub-millisecond structural validation on tools/call — missing or mistyped fields are caught before they reach the model, no LLM involved.
- Schema-drift detection diffs tool definitions across calls and classifies changes as missing, added, or retyped fields.
- Tool-definition pinning: a SHA-256 hash of every tool definition on first sight, with an alert (optionally a block) on any unexplained change.
02
Anomaly & security
Streaming statistics catch behavioral drift locally, and tool definitions get an LLM-based security scan whenever they change — never per call, and never on your call payloads.
- Streaming statistics (t-digest / EWMA) on per-tool latency, error rate, argument shape, and call frequency — no machine learning, no LLM, runs entirely inside your network.
- Tool-definition security scanning runs on the hosted control plane, triggered only by a definition change — it sees tool metadata, never call arguments or results.
- Async and fail-open by default: this tier detects and alerts rather than blocking traffic in real time. We publish our detector's false-positive/false-negative rate instead of claiming it stops every attack.
Integrate Outpost
Request beta access today
Ready to secure your agent workflows with Outpost? Reach out to request access to our private beta and discuss your integration requirements.