Pith Number

pith:UVDUHUI5

pith:2026:UVDUHUI5KFRRXRKNIZ6XZHPRMJ

not attested not anchored not stored refs pending

Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives

Daeyeon Son

Kernel-resident gateway for AI agent tool calls makes 10-line userspace bypasses structurally impossible.

arxiv:2604.16870 v2 · 2026-04-18 · cs.CR · cs.AI · cs.OS

Open paper page JSON Open Graph Bundle Merged state Verified badge What is a Pith Number?

Add to your LaTeX paper

\usepackage{pith}
\pithnumber{UVDUHUI5KFRRXRKNIZ6XZHPRMJ}

Prints a linked badge after your title and injects PDF metadata. Compiles on arXiv. Learn more · Embed verified badge

Record completeness

1 Bitcoin timestamp

2 Internet Archive

3 Author claim open · sign in to claim

4 Citations open

5 Replications open

✓ Portable graph bundle live · download bundle · merged state

The bundle contains the canonical record plus signed events. A mirror can host it anywhere and recompute the same current state with the deterministic merge algorithm.

Claims

C1strongest claim

a 10-LoC userspace bypass that defeats existing guardrail libraries is structurally impossible against the kernel-resident gate; all 15 WASM-to-system host functions route through the gateway.

C2weakest assumption

That the ProbeLogits semantic gate (detailed in the companion paper) reliably identifies unsafe or unintended MCP tool calls across realistic adversarial and benign scenarios, as the reported support is an ablation on a 101-prompt benchmark.

C3one line summary

Governed MCP implements kernel-level governance for MCP tool calls in AI agents through a 6-layer pipeline including ProbeLogits semantic verification, with an ablation showing F1 drop from 0.773 to 0.327 without it and structural prevention of userspace bypasses.

Receipt and verification

First computed	2026-07-07T02:18:40.734679Z
Builder	pith-number-builder-2026-05-17-v1
Signature	Pith Ed25519 (`pith-v1-2026-05`) · public key
Schema	pith-number/v1.0

Canonical hash

a54743d11d51631bc54d467d7c9df16255ec1c915b35955ea66a34da6cb246ee

Aliases

arxiv: 2604.16870 · arxiv_version: 2604.16870v2 · doi: 10.48550/arxiv.2604.16870 · pith_short_12: UVDUHUI5KFRR · pith_short_16: UVDUHUI5KFRRXRKN · pith_short_8: UVDUHUI5

Agent API

Resolver JSON Graph JSON Events JSON Schema Signing key

Verify this Pith Number yourself

curl -sH 'Accept: application/ld+json' https://pith.science/pith/UVDUHUI5KFRRXRKNIZ6XZHPRMJ \
  | jq -c '.canonical_record' \
  | python3 -c "import sys,json,hashlib; b=json.dumps(json.loads(sys.stdin.read()), sort_keys=True, separators=(',',':'), ensure_ascii=False).encode(); print(hashlib.sha256(b).hexdigest())"
# expect: a54743d11d51631bc54d467d7c9df16255ec1c915b35955ea66a34da6cb246ee

Canonical record JSON

{
  "metadata": {
    "abstract_canon_sha256": "d8841aa4de7c071d81abd4fd1c3963a816845eac8874a693ffff78e8c36443d0",
    "cross_cats_sorted": [
      "cs.AI",
      "cs.OS"
    ],
    "license": "http://creativecommons.org/licenses/by/4.0/",
    "primary_cat": "cs.CR",
    "submitted_at": "2026-04-18T06:40:20Z",
    "title_canon_sha256": "55c75cf4f14ad024be9d2e0ae6469b4a34f4d3a26f1d79df791c39e1a9497648"
  },
  "schema_version": "1.0",
  "source": {
    "id": "2604.16870",
    "kind": "arxiv",
    "version": 2
  }
}