JAK Shield - The Execution Firewall for AI Agents

The description states that JAK Shield is a local-first, MCP-native execution firewall for AI agents. It operates between an AI agent and its tools, evaluating every protected tool call and returning one of five decisions: allow, redact, rewrite, requires_approval, or block.

It uses:

• A deterministic policy engine as the final enforcement authority.
• Optional integration with GPT-5.6 for semantic risk analysis (used only for advisory purposes).
• Taint tracking to monitor untrusted information across multiple tool calls.
• Role-based access control (RBAC) and exact-call, scoped, single-use authorisation tokens.
• A Floodgate emergency lockdown feature that closes all non-read-only execution paths.
• Cryptographically signed audit records.

It supports:

• MCP over STDIO and Streamable HTTP
• REST API
• Next.js dashboard
• Electron desktop app

The product is built as a TypeScript monorepo, with components including:

• Policy engine
• MCP server (STDIO & HTTP)
• Fastify REST API
• Human approval gateway
• PII/redaction layer
• Prompt-injection detection
• Signed audit infrastructure
• Protected connector operations

It integrates with Codex via an MCP configuration, routing external side effects through shield.proxy_tool_call and using shield.evaluate_tool_call for non-destructive evaluations.

The description states that the project was inspired by the realization that prompt-level safety is insufficient when AI agents can perform real-world actions like sending emails, running terminal commands, accessing databases, deploying software, publishing content, and initiating payments.

It claims to address a fundamental security problem: the same model deciding what action to take should not be the final authority deciding whether that action is safe.

The positioning has evolved from:

• A general AI agent safety tool →
• A hard execution boundary between intention and real-world impact →
• A deterministic policy engine with optional semantic analysis, where AI is advisory, not authoritative

It also claims to be a universal execution-security layer for autonomous agents, aiming to give developers freedom without unchecked authority.

The description does not explicitly name target customers or define an Ideal Customer Profile (ICP). However, it implies that the primary users are:

• Developers building AI agents
• Teams integrating AI with real-world tools and systems
• Organizations using MCP-compatible AI frameworks such as Codex

It is positioned for developers who want to build powerful AI systems without giving those systems unchecked authority over real-world tools.

Not evidenced. The description does not contain any information about pricing, monetization strategy, or business model.

The project is built as a TypeScript monorepo using:

• Fastify
• Next.js
• Electron
• Docker
• PostgreSQL
• Prisma
• Prometheus
• Zod
• Vitest
• Turborepo

It uses:

• MCP (Model Control Protocol) over STDIO and Streamable HTTP
• REST API
• GPT-5.6 via OpenAI Responses API for optional semantic analysis
• Local pre-egress redaction before AI analysis
• Taint tracking across tool calls
• Signed audit trails

It includes:

• A verification flow that tests MCP startup, tool discovery, evaluation, proxying, and destructive SQL blocking.
• Reference integrations for additional agent frameworks.

Not evidenced. The description states:

• JAK Shield is ready for controlled early testing, not unrestricted production deployment.
• It was submitted to the OpenAI 2026 hackathon.
• It has undergone:
  • Clean Windows virtual-machine acceptance
  • Code signing (planned)
  • Independent penetration test (planned)
  • Multi-tenant hardening (planned)

No revenue, customers, or adoption data are provided.

Not evidenced. The description does not mention competitors or the competitive landscape.

• No traction or commercial use: The product is described as ready for early testing but not production deployment.
• Unverified AI integration: GPT-5.6 is used only for advisory purposes, but its actual performance and reliability in real-world scenarios are unknown.
• Limited validation: No third-party penetration tests, no customer feedback, no live deployments.
• Self-reported maturity: The team states it’s not ready for production use, which raises questions about readiness for enterprise adoption.
• Single-founder team: Only one member listed (REETURAJ GOSWAMI), which may limit scalability or operational capacity.

1. What specific real-world integrations or use cases have been tested beyond the hackathon?
2. How is the deterministic policy engine validated and audited for correctness?
3. Has the team conducted any internal or external security testing (e.g., penetration tests)?
4. Are there any early adopters or pilot customers using this in a controlled environment?
5. What are the plans for scaling beyond the current monorepo architecture?
6. How does JAK Shield handle edge cases where the deterministic engine and GPT-5.6 disagree?
7. What is the roadmap for enterprise features, multi-tenancy, and hosted deployment?