v0.3.0

The agent firewall: inspection of agent tool calls (Claude Code hooks, MCP, and tool blocks in
API traffic), plus output moderation, and the first signed release.

Added

• Agent firewall library (llm-firewall-agent): one AgentEvent schema, facet projection
  into the existing detectors, winnowed fingerprinting, taint tracking, action classification,
  egress extraction, subagent authority containment, and an agent policy engine returning
  Allow / Ask / Deny.
• agentfw daemon: agentfw serve wired into Claude Code's native hooks, agentfw install,
  agentfw replay; ships in shadow mode.
• Local-model judge tier: an escalate policy action with a required fallback that asks a
  loopback-only local model one narrow question, and may only tighten a verdict. Off by default.
• MCP supply-chain collector: agentfw mcp stdio proxy pinning each server's tool manifest
  and catching manifest drift, tool-name shadowing, and description poisoning. Off by default.
• API collector: the proxy inspects tool_use / tool_result blocks in OpenAI/Anthropic
  traffic (agent_inspection config block, off by default, shadow-first).
• Output moderation in the proxy (output_moderation config block): harmful replies flagged
  or refused regardless of backend. Off by default, flag before block.
• Benchmarks: agent-attack corpus and --agent scorecard mode; --direction and
  --moderation-threshold for output-path measurement.
• Release artifacts: prebuilt llm-firewall + agentfw archives for Linux (x86_64,
  aarch64) and macOS (x86_64, arm64), with SHA256SUMS, keyless Sigstore signature bundles,
  SLSA build provenance (GitHub artifact attestation) and CycloneDX SBOMs. See "Verifying a release" in the README.

Fixed

• Injection policy rules are now scoped to the input path, so they no longer run on (and
  over-block) model replies.

Security

• Dependency advisories resolved (h2, rustls, unsafe-libyaml).
• CI hardening: SHA-pinned actions, cargo-deny, gitleaks, CodeQL, ClamAV, OpenSSF Scorecard, and
  keyless-signed container images with SLSA provenance and SBOM attestations.

Verifying this release

Every archive, SBOM and SHA256SUMS has a keyless Sigstore signature bundle
(<file>.sigstore.json), and llm-firewall-v0.3.0.intoto.jsonl is SLSA build provenance for
the archives and SBOMs. The container image ghcr.io/carbon-evolution/llm-firewall:0.3.0 is signed the same way.
See Verifying a release for the commands.

What's Changed

• feat(agent): agent-loop inspection library + README rewrite (phase 08) by @carbon-evolution in #11
• docs: rendered agent data-flow diagram (replaces Mermaid) by @carbon-evolution in #12
• docs: commit the agent layer to recognized public benchmarks by @carbon-evolution in #13
• feat(agentfw): daemon + Claude Code hook collector (phase 09) by @carbon-evolution in #14
• docs: audit logs are never published — state the data handling rule by @carbon-evolution in #15
• feat: local judge tier (phase 10) by @carbon-evolution in #16
• feat: MCP collector — handshake supply-chain defenses (phase 11a) by @carbon-evolution in #17
• feat: API collector — agent inspection in the proxy (phase 11b) by @carbon-evolution in #18
• feat: agent-attack benchmark & scorecard (phase 12) by @carbon-evolution in #19
• feat: model-agnostic output moderation (phase 13) by @carbon-evolution in #20
• docs: phase 14 plan — evasion by register (planned, not started) by @carbon-evolution in #21
• fix(deps): resolve RustSec advisories (h2, rustls, unsafe-libyaml) by @carbon-evolution in #22
• ci: security hardening (pinned actions, cargo-deny, gitleaks, CodeQL, ClamAV, Scorecard, signed images) by @carbon-evolution in #23
• build(deps): bump rand from 0.8.7 to 0.10.2 by @dependabot[bot] in #26
• build(deps): bump sha2 from 0.10.9 to 0.11.1 by @dependabot[bot] in #28
• docs(security): OWASP LLM Top 10 2025 + OWASP Top 10:2025 assessment by @carbon-evolution in #30
• ci(release): signed GitHub Releases — binaries, SBOMs, Sigstore bundles, SLSA provenance (v0.3.0) by @carbon-evolution in #31

New Contributors

• @dependabot[bot] made their first contribution in #26

Full Changelog: v0.2.0...v0.3.0

v0.2.0 — Obfuscation / evasion resilience

Dual-scan obfuscation/evasion normalization. The firewall now catches attacks hidden by zero-width characters, Unicode homoglyphs, or base64 — without over-blocking normal prompts.

Highlights

• Dual-scan pre-pass — the same injection / secret / PII detectors run a second time on a de-obfuscated copy; the original text is still what gets forwarded and masked, and obfuscation alone is never a block reason — only a decoded attack is.
  • Tier 1 — strip zero-width & bidi controls (Trojan-Source, CVE-2021-42574)
  • Tier 2 — NFKC fold + curated Unicode-confusable (UTS #39) Cyrillic/Greek → ASCII
  • Tier 3 (opt-in) — decode base64-looking segments and scan the payload
• Proxy normalize config block; benchmark --no-normalize / --normalize-base64 flags; scripts/obfuscate-dataset.py.

Validation

• Offline rule-layer recall on obfuscated attacks: 0.0% → 14.5% (base64 0.0% → 30.6%) at 0.00% FPR on a multilingual benign control.
• External check with NVIDIA garak encoding.InjectBase64 — see docs/garak-validation.md (honestly framed, incl. the base64 output-side over-defense caveat).

Container image

```
docker pull ghcr.io/carbon-evolution/llm-firewall:0.2.0
```

Full changelog: CHANGELOG.md

v0.1.0 — LLM Firewall

First public release — a pure-Rust firewall for LLMs: an OpenAI-compatible + native Anthropic reverse proxy that inspects, scores, and filters prompts and responses.

Highlights

• Detection: prompt injection (regex + heuristics + optional DeBERTa ML), secrets, PII masking, output-handling (OWASP LLM05), and optional content moderation (Trust & Safety).
• Standards: every finding tagged with OWASP LLM Top 10 (2025) + MITRE ATLAS; --report coverage/risk report.
• Providers: OpenAI /v1/chat/completions and native Anthropic /v1/messages; SSE streaming.
• Benchmark (real, dual-metric): safe-guard 84.3% @ 0.2% FPR · jailbreak 85.6% @ 1.6% · deepset 41.4% @ 1.0%; content moderation lifts JailbreakBench 0% → 58%.
• 106 tests, clippy -D warnings + fmt clean in both build modes.

Container image

Published to GitHub Packages on release:
```bash
docker pull ghcr.io/carbon-evolution/llm-firewall:0.1.0
```

See the CHANGELOG for details.

🤖 Generated with Claude Code