Source-linked AI summary
ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation
Xiaochong Jiang, Shiqi Yang, Ziwei Li, Lifei Liu, Haoran Yu, Yichen Liu
TL;DR
Tool-using agents can satisfy individual permission checks while composing confidential data into unauthorized end-to-end flows. ChainCaps attaches sink-specific budgets to values and intersects them through tool composition, reducing attack success from 25–68% to 0–4.8% while preserving 96–100% benign completion. Its guarantees are limited to explicit flows under trusted manifests and proxy-visible effects.
Problem
Locally authorized tool calls can compose into unauthorized end-to-end effects, creating a runtime composition-safety gap for deployed agents.
Method
ChainCaps attaches sink-specific authority budgets to values and propagates them by intersection through a transparent MCP proxy.
Results
Attack success falls from 25–68% to 0–4.8% across 82 tasks while benign completion remains 96–100%.
Takeaways & Limitations
ChainCaps provides an enforceable invariant for explicit dataflow: composition can attenuate authority but cannot create sink authority absent from source budgets.
Takeaways & Limitations
The guarantee depends on trusted manifests, intact proxy enforcement, and proxy-visible explicit flows; the evaluation is a targeted stress test rather than a population estimate.
Abstract
from arXiv · showhide
Tool-using agents increasingly operate in open-ended deployment environments, where they compose file systems, web APIs, code interpreters, and enterprise services at runtime. This creates a safety gap in tool composition: an agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect, such as reading a confidential document, summarizing it, and sending the summary to an external endpoint. We call this failure mode permission laundering. ChainCaps addresses it with a runtime rule: every value carries a sink-specific capability budget, and tool composition propagates budgets by intersection. A value can preserve or lose authority as it moves through a tool chain, but it cannot gain new authority through composition. We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers. On 82 tasks across five frontier models from three providers, ChainCaps reduces attack success rate from 25-68% to 0-4.8% while preserving 96-100% benign completion. In replay experiments, it also outperforms scalar-IFC and per-function-isolation baselines. Manifest quality is the dominant deployment bottleneck: expert manifests reach 100% attack blocking, while naive manifests fall to 27.3%. Our claims are limited to explicit-flow composition safety under trusted manifests and proxy-visible data movement, a practical gap in deployed tool-using agents today.
1. Introduction
Tool-using agents can turn individually authorized calls into unauthorized end-to-end data flows. ChainCaps addresses this composition gap by monotonically attenuating sink-specific authority and substantially reducing attacks while preserving benign completion.
- The composition-safety gap: Runtime dataflow matters because prompt wording, retrieved context, partial outputs, and tool returns determine compositions that static or per-function checks may miss.The unsafe flow may only become apparent while the workflow executes.
- ChainCaps: ChainCaps propagates each value’s sink-specific authority by intersection, allowing authority to persist or decrease but not increase through composition.The mechanism attaches budgets to values and intersects contributing inputs with the tool’s declared pass-through budget.
- The composition-safety gap: Permission laundering occurs when locally authorized tool calls compose into an unauthorized end-to-end effect.A workflow can read restricted data, transform it, and send it externally without any single tool violating its local rule.
- ChainCaps: ChainCaps is implemented as a transparent MCP proxy with manifests, declassification tokens, fail-closed unknown-sink handling, session isolation, and manifest linting.The proxy operates between agents and existing tool servers without requiring changes to either side.
- Scope: The claims are limited to explicit-flow composition safety under trusted manifests and intact proxy enforcement.The scope excludes covert channels, implicit flows through hidden model state, latent multimodal diagnostic memory, and manifest policy errors.
2. Related Work
Related defenses address value-level information flow, execution isolation, monitoring, and broader agent threats, but ChainCaps focuses on sink-specific authority of derived values. These approaches are complementary because application-layer flow control does not cover every execution or side-effect boundary.
- Information-flow control: ChainCaps differs from scalar information-flow control by tracking which downstream sinks each value may reach, rather than only scalar confidentiality or integrity labels.The paper reports that this sink-specific representation blocks substantially more replay traces than a scalar-label baseline on the same logs.
- Execution isolation: Isolation mechanisms constrain tool, server, or execution boundaries, whereas ChainCaps constrains derived-value authority as data moves through a workflow.The paper characterizes these approaches as complementary rather than competing.
- Scope and complementarity: Application-layer enforcement cannot see some shell-level, OS-level, or hidden tool effects, leaving defense-in-depth mechanisms necessary.Residual script indirection and shell-pipe laundering fall outside the proxy’s visibility.
- Detection and monitoring: Detection, testing, and monitoring systems expose or evaluate unsafe compositions, while ChainCaps enforces an invariant during explicit dataflow.The related systems include policy reasoning, MCP defense in depth, fuzzing, and orchestrator-based safety evaluation.
3. Monotonic Capability Attenuation
ChainCaps enforces composition safety by attaching sink-specific budgets to values and propagating them through tool chains via intersection. Its proxy mediates calls, blocks unauthorized sinks, and guarantees non-amplification under trusted manifests and proxy-visible dataflow.
- Scope: The guarantee assumes relevant calls pass through the proxy, manifests correctly identify sources and sinks, and data movement remains observable.The scope excludes covert channels, hidden model-state leakage, compromised servers, manifest policy errors, and OS-level side effects bypassing the proxy.
- Budget Algebra: Sink privileges pair an operation with a scope, with narrower scopes representing weaker privileges.Examples include HTTP sending, file writing, and execution constrained by URL prefixes, filesystem paths, or command families.
- Budget Model: Every value carries a budget describing the sinks it may still reach, and source values receive initial budgets.Budgets are downward-closed sets of sink privileges assigned when values enter from sources such as files, credential stores, or databases.
- Budget Propagation: A derived value’s budget is the intersection of its inputs’ budgets and the producing tool’s pass-through budget.Mixing a restrictive value with a permissive one preserves the restrictive authority, so transformation cannot restore lost permissions.
- Runtime Enforcement: Sink calls are allowed only when the required privilege remains authorized by all contributing values; otherwise the proxy blocks the call unless declassification applies.The proxy computes contributing values through online dataflow and conservatively tracks context-derived arguments.
- Guarantee: Without declassification, composition cannot grant a sink privilege absent from the initial budgets of contributing sources.The non-amplification theorem formalizes that every allowed sink requirement lies in the intersection of contributing source budgets.
- Implementation: ChainCaps is implemented as an MCP proxy that intercepts calls and results without modifying the agent or tool servers.The proxy maintains budget mappings, an online dataflow DAG, and context state; manifests define source, sink, and pass-through policies.
4. Evaluation
ChainCaps is evaluated on live frontier-model agents and replayed traces using adversarial and benign tasks, with attack blocking, benign completion, baseline comparisons, and deployment assumptions examined. The results show strong protection across models, but residual failures and effectiveness depend on manifest quality and proxy-visible data movement.
- Evaluation setup: 82 tasks comprise 56 adversarial tasks across 12 attack categories and 26 benign tasks across 5 workflow types.The evaluation uses live and replay settings, with three fresh-session runs per condition across five models from three providers.
- Main results: Baseline ASR ranges from 25.2% to 67.8%, while ChainCaps reduces all five models to 0–4.8% ASR with 96–100% benign completion.The result holds across providers and model families without model-specific tuning.
- Main results: Seven of 12 attack categories are fully neutralized under gold manifests, while residual failures cluster in execution laundering, indirect injection, and shell exfiltration.Residual cases involve authority being re-expressed at boundaries the proxy does not fully see, such as later script execution or shell pipes.
- Comparison with prior defenses: Replay comparisons show ChainCaps blocks 59.5% of GPT-5.1 attack traces versus 16.1% for Fides and 10.1% for PFI.The baselines model scalar value labels and per-function isolation under shared traces and metadata rather than complete system implementations.
- Ablation and manifest quality: Expert manifests achieve 100% attack blocking and 100% benign completion, whereas naive manifests fall to 27.3% blocking and 50% benign completion.Removing the meet rule reduces attack blocking by 17 percentage points, while removing other components costs 7–10 points each.
- Threats to validity: The evaluation is stress-test evidence rather than a population estimate, and its strongest results assume gold manifests and proxy-visible effects.Replay comparisons isolate policy expressiveness under shared traces rather than ranking complete competing implementations.
5. Conclusion
ChainCaps enforces explicit-flow composition safety by ensuring authority attenuates monotonically through tool chains. Across five frontier models and 82 tasks, it sharply reduced attack success while preserving benign completion, but deployment effectiveness depends on accurate manifests and proxy-visible data movement.
- Attack success fell from 25–68% to 0–4.8% across five frontier models and an 82-task stress-test suite.Benign completion remained 96–100%, with submillisecond overhead.
- Explicit-flow composition safety is enforceable in MCP-style ecosystems when manifests are accurate and relevant calls pass through the proxy.The paper identifies manifest quality as the binding deployment constraint rather than the runtime algebra.
- Closing residual failures such as script indirection and shell-pipe laundering requires enforcement below the application layer or monitoring beyond the proxy.The proposed boundary includes composite-sink treatment with OS-level inspection or network-layer monitoring.
- ChainCaps provides a runtime invariant in which values may lose authority through composition but cannot regain authority their sources lacked.The invariant targets explicit dataflow across dynamically assembled workflows.
- The public artifact is available under an MIT license.The repository is hosted at github.com/Jxcup/chaincaps-code.