Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Tool-call safety moves into the OS kernel so a 10-line userspace script cannot bypass it.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-12 19:12 UTC pith:UVDUHUI5

load-bearing objection Kernel MCP governance with a logit gate is a real systems idea, but the structural-impossibility claim is overstated while ring-3 syscalls stay open. the 3 major comments →

arxiv 2604.16870 v2 pith:UVDUHUI5 submitted 2026-04-18 cs.CR cs.AIcs.OS

Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives

Daeyeon Son This is my paper
classification cs.CR cs.AIcs.OS
keywords Governed MCPProbeLogitskernel-level tool governanceAI agent safetyModel Context Protocollogit-based safety primitiveWASM host functionsAnima OS
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

AI agents treat external tool calls (files, network, APIs) as privileged operations with real side effects, yet today's safety checks sit in userspace and can be skipped by a short script. This paper proposes Governed MCP: a kernel-resident gateway that interposes on every registered MCP tool call and every WASM-to-system host function through a six-layer pipeline whose load-bearing check is ProbeLogits, a single probe-prompt prefill plus one logit read. The author implements the design in a bare-metal x86-64 kernel written in Rust and shows that the non-inference layers cost only microseconds while ProbeLogits itself is several times faster than a full Llama Guard 3 pass; an ablation removing that layer collapses F1 by more than 0.4. The claim is that once mediation lives inside the kernel, the classic userspace bypass becomes structurally impossible (modulo a disclosed set of still-ungated ring-3 paths). A sympathetic reader cares because this reframes agent safety from an application library problem into an operating-system primitive that can be audited, measured, and hardened like any other privileged interface.

Core claim

Tool-call governance is feasible as an OS primitive: a kernel-resident Governed MCP gateway can mediate every registered MCP tool and every WASM host function via a six-layer pipeline whose load-bearing semantic check is ProbeLogits, rendering the 10-line userspace bypass that defeats existing guardrail libraries structurally impossible (aside from a disclosed set of still-ungated ring-3 syscall paths).

What carries the argument

ProbeLogits, a logit-based safety primitive that performs one probe-prompt prefill and a single logit read, acts as the load-bearing semantic gate inside a six-layer kernel pipeline (schema validation, trust tier, rate limit, adversarial pre-filter, ProbeLogits, constitutional policy match) plus a Blake3-hashed audit chain.

Load-bearing premise

Mediating registered MCP tools and WASM host functions is enough to claim structural impossibility of bypass while a disclosed set of ring-3 syscall paths stays ungated, and a single probe-prompt plus one logit read is a reliable semantic safety gate across models.

What would settle it

A working userspace agent that issues a harmful MCP tool call or WASM host-function invocation without ever entering the kernel gateway, or a silicon re-measurement on the same hardware and models that fails to recover the reported F1 collapse of 0.432 when ProbeLogits is removed.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The manuscript proposes Governed MCP: a kernel-resident gateway that interposes on every registered MCP tool call and every WASM-to-system host function via a six-layer pipeline (schema validation, trust tier, rate limit, adversarial pre-filter, ProbeLogits semantic gate, constitutional policy match) plus a Blake3 audit chain. The load-bearing check is ProbeLogits—one probe-prompt prefill and a single logit read. The system is implemented in Anima OS (~286k LOC bare-metal Rust). Reported costs are 11.3 µs for the non-inference path and 332–556 ms for ProbeLogits across three 7–8B models (2.4–3.4× faster than Llama Guard 3 on the same hardware). An ablation claims F1 falls from 0.789 to 0.357 without ProbeLogits. Multi-benchmark numbers (HarmBench, XSTest, ToxicChat) are reported as architecture-agnostic. The central claim is that mediating the MCP/WASM surface makes the classic 10-line userspace guardrail bypass structurally impossible, with a disclosed residual set of ungated ring-3 syscall paths left for future work.

Significance. If the result holds at the claimed scope, the paper would be a concrete demonstration that agent tool-call governance can be lifted from userspace libraries into an OS mediation surface, with a measured ablation showing that hand rules alone are insufficient and with multi-model evidence that a logit-read primitive is architecture-agnostic. The combination of a bare-metal Rust kernel implementation, silicon-measured latency, Blake3 audit chaining, and an explicit ablation is a genuine systems contribution relative to pure application-layer guardrails. The significance is bounded by the residual ungated ring-3 ABI: the work is strongest as “kernel mediation of the MCP/WASM tool surface,” weaker as a full OS-primitive claim that tool side effects cannot be reached without governance.

major comments (3)
  1. The abstract’s structural-impossibility claim (“the 10-line userspace bypass … is structurally impossible”) is load-bearing for the “OS primitive” framing, yet is immediately qualified by “a disclosed set of ring-3 syscall paths remains ungated.” Ordinary ring-3 ABI paths (open/write/connect/execve and equivalents) can realize the same file, network, and process side effects that MCP tools expose. Mediating registered MCP tools and WASM host functions therefore shows that the MCP/WASM surface is gated; it does not show that tool-call side effects themselves are gated. Either (a) inventory the remaining open ring-3 paths and argue they cannot produce equivalent effects under the Anima threat model, or (b) restate the claim as surface-scoped mediation rather than structural impossibility of bypass. Without one of those, the strongest claim does not hold.
  2. ProbeLogits is presented as the load-bearing semantic gate (ablation ΔF1 = −0.432). A single probe-prompt prefill plus one logit read is a free-parameter construction (probe text, decision threshold, model choice). The abstract does not state how the threshold was fixed, whether it was tuned on the evaluation suites, or how sensitive F1 is to prompt/threshold choice across Qwen2.5-7B, Llama-3-8B, and Mistral-7B. For the ablation and multi-benchmark claims to support “architecture-agnostic” reliability, the manuscript needs a fixed decision rule, sensitivity analysis, and an explicit statement that thresholds were not fit to the reported test sets.
  3. Evaluation claims (HarmBench 98–99% non-copyright block, XSTest 98.5–100% unsafe recall, ToxicChat parity with Llama Guard 3, F1 0.789) are central but, on the abstract alone, lack dataset construction details, decision thresholds, error bars, and the exact Llama Guard 3 baseline protocol (same hardware, same prompts, same allow/deny mapping). These are required for the multi-model and ablation results to be assessable; without them the quantitative support for the load-bearing role of ProbeLogits cannot be verified.
minor comments (5)
  1. Clarify the threat model early: who controls the agent process, whether the adversary can issue raw syscalls, and what “structurally impossible” means under that model.
  2. Define “silicon-measured” and the measurement methodology for the 11.3 µs and 332–556 ms figures (timer source, warm/cold cache, batching, hardware).
  3. Name the exact constitutional policy match rules and trust-tier parameters so the free parameters of the six-layer pipeline are enumerable.
  4. Resolve the scope of “every registered MCP tool” vs. dynamic tool registration: can a userspace agent register a new tool that bypasses the gateway?
  5. The abstract-only form leaves notation for ProbeLogits (which logit, how the probe prompt is constructed) underspecified; a short formal definition would help.

Circularity Check

0 steps flagged

No significant circularity: external benchmarks and ablation ground the claims; residual is ordinary systems self-measurement of the author's own kernel.

full rationale

This is an abstract-only systems paper whose load-bearing empirical claims are evaluated against external suites (HarmBench, XSTest, ToxicChat) and a third-party baseline (Llama Guard 3), with an internal ablation (rules-only vs rules+ProbeLogits) that is a genuine control rather than a tautology. Latency and F1 numbers are silicon-measured outcomes, not fitted parameters renamed as predictions. There is no uniqueness theorem, no self-citation chain justifying the central premise, no ansatz smuggled via prior author work, and no self-definitional loop (ProbeLogits is a method whose reliability is tested, not assumed by construction). The structural-impossibility claim is qualified by the paper itself (ungated ring-3 paths), which is a completeness/correctness issue, not circularity. Residual risk is the ordinary fact that the kernel, gateway, and probe prompts are the author's own artifacts without third-party reimplementation—normal for OS papers and not a derivation that reduces to its inputs. Score 1 for that residual self-measurement; steps empty because no enumerated circular pattern is present.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 3 invented entities

From the abstract alone, the claim rests on standard OS mediation assumptions, MCP as the tool interface, the reliability of a single-logit probe as a semantic safety signal, and hand-chosen pipeline thresholds/policies that are not numerically specified here. ProbeLogits and the Governed MCP gateway are the main invented constructs; independent evidence is claimed via external benchmarks but not inspectable from the abstract.

free parameters (3)
  • ProbeLogits decision threshold / probe prompt
    The semantic gate is a probe-prompt prefill plus a single logit read; the abstract does not state the prompt text or the accept/reject threshold, both of which must be chosen and strongly affect F1.
  • Trust-tier and rate-limit parameters
    Layers 2–3 are trust tier and rate limit; abstract gives no numeric policy, so these are free operational parameters of the gateway.
  • Constitutional policy match rules
    Final layer matches constitutional policy; the policy set is author-defined and not specified in the abstract.
axioms (4)
  • domain assumption MCP tool calls are the right mediation surface for agent side effects (analogous to syscalls).
    Stated in the opening framing; if agents bypass MCP, kernel mediation of MCP alone does not govern side effects.
  • ad hoc to paper A single probe-prompt prefill and one logit read is a sufficient semantic safety signal for tool-call allow/deny.
    ProbeLogits is the load-bearing layer; the abstract treats this design as adequate based on reported F1/ablation, without deriving sufficiency from first principles.
  • domain assumption Kernel interposition on registered MCP tools and WASM host functions is the correct completeness boundary for 'structurally impossible' userspace bypass.
    Qualified immediately by disclosed ungated ring-3 syscall paths; completeness is an OS-security modeling choice.
  • standard math Standard systems measurement and classification metrics (latency, F1, recall on named benchmarks) are valid for the safety claim.
    Ordinary empirical methodology assumed throughout the results summary.
invented entities (3)
  • ProbeLogits independent evidence
    purpose: Load-bearing semantic safety gate: one probe-prompt prefill plus a single logit read to classify tool calls.
    Named as the central primitive; independent evidence claimed via multi-model benchmark numbers, but mechanism and thresholds are not fully specified in the abstract.
  • Governed MCP gateway (6-layer kernel pipeline + Blake3 audit chain) no independent evidence
    purpose: Kernel-resident mediation of every MCP tool call and WASM host function so userspace cannot skip safety.
    The system being proposed; evidence is the author’s Anima OS implementation and reported measurements, not an external prior object.
  • Anima OS no independent evidence
    purpose: Bare-metal x86-64 Rust kernel (~286k LOC) that hosts the gateway.
    Implementation vehicle; not independently evidenced outside the author’s work in the abstract.

pith-pipeline@v1.1.0-grok45 · 6319 in / 3309 out tokens · 37555 ms · 2026-07-12T19:12:56.225599+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives." pith.science (2026). https://pith.science/paper/UVDUHUI5

@misc{pith2026260416870,
  author       = {Pith},
  title        = {Pith review of: Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UVDUHUI5}},
  note         = {Machine review of arXiv:2604.16870}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

AI agents increasingly call external tools (file system, network, APIs) through the Model Context Protocol (MCP). These tool calls are the agent's syscalls: privileged operations with side effects on shared state, yet today's safety enforcement lives entirely in userspace, where a 10-line script can bypass it. I propose Governed MCP, a kernel-resident tool governance gateway built on a logit-based safety primitive (ProbeLogits). The gateway interposes on every MCP tool call in a 6-layer pipeline: schema validation, trust tier, rate limit, adversarial pre-filter, a ProbeLogits semantic gate (the load-bearing check), and constitutional policy match, with a Blake3-hashed audit chain. I implement Governed MCP in Anima OS, a bare-metal x86-64 kernel in ~286,000 lines of Rust. The five non-inference layers plus the audit append cost a measured 11.3 us per call; the ProbeLogits gate (one probe-prompt prefill plus a single logit read) costs 332-556 ms per classification across Qwen2.5-7B, Llama-3-8B, and Mistral-7B, 2.4-3.4x faster than a Llama Guard 3 pass on the same hardware. A silicon-measured ablation shows that removing the ProbeLogits layer collapses F1 from 0.789 to 0.357 (delta-F1 = -0.432): hand-rule firewalling alone is insufficient. Every WASM-to-system host function and every registered MCP tool is mediated by the kernel gateway, so the 10-line userspace bypass that defeats existing guardrail libraries is structurally impossible; a disclosed set of ring-3 syscall paths remains ungated pending future work. Multi-model validation across three architectures (HarmBench 98-99% non-copyright block, XSTest 98.5-100% unsafe recall, ToxicChat parity with Llama Guard 3) shows the underlying primitive is architecture-agnostic. Governed MCP demonstrates that tool-call governance is feasible as an OS primitive, not just an application-layer concern.

Figures

Figures reproduced from arXiv: 2604.16870 by Daeyeon Son.

Figure 1
Figure 1. Figure 1: Trust-boundary placement of the gateway. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Elastic Gang: Per-Token Membership Change for a Hard-Barriered LLM Inference Gang Co-Scheduled with OS Processes

    cs.OS 2026-07 conditional novelty 7.0

    An ACK-latched epoch protocol lets a hard-barriered CPU LLM inference gang change membership per token bit-exactly and Pareto-dominate static core partitions on general throughput.