Trifecta Gate

An AI assistant that reads your files, reads strangers' mail and can send email can be talked into leaking.

Trifecta Gate finds that combination in an agent's tools and blocks the send when the address came from a stranger, not from you.

Three abilities form a triangle; the gate cuts the edge that sends data out. Reads your private data Reads outsiders' text Can send data out gate

Does your agent have all three?

Paste the tool list of your AI agent: MCP tools/list JSON, or one tool per line like send_email(to, body): Send an email.

Watch one real run

Loading the recorded run…

What we found in public MCP servers

How the gate decides

The gate never asks a model whether text looks malicious. It checks where an outgoing message is going and where that address came from.

  1. You named it: the address, channel or exact link appears in your request, your allowlist, or you confirmed it. Allowed.
  2. Someone else named it, and private data is in play: the agent has read your files or mail, or you typed a secret. Blocked, and the gate (not the agent) asks you, showing where the address came from.
  3. Someone else named it, nothing private yet: nothing to leak. Allowed, so browsing still works.
  4. Private data hidden in the call: fingerprints of what the agent read catch it even when re-cased, split or base64-encoded. Blocked.
  5. Writing to your own workspace: a calendar entry or a file with no outside recipient. Allowed.

Links inside a message body count as destinations too, because previews and images fetch them. A site you only mention by name is trusted for that site alone, without query strings, and never for shared platforms such as docs.google.com or github.com. Tools the rules cannot label are treated as private and outgoing.

What it does not catch

If you name the recipient yourself, the gate lets the message go even if the agent was tricked into adding extra data. Text you paste into your own request counts as your words. A compromised tool server, and leaks through side channels such as timing, are out of scope. In proxy mode the gate cannot see your chat, so destinations come from the allowlist and your confirmations only.