Proxy Layer

Full agent interception — MCP gateway, SDK middleware, API event stream

Proxy Layer Architecture

The Quint Proxy is a transparent interception layer that wraps around an agent system. It captures every outbound action before it executes and checks it against the scope compiled from the agent’s stated intent — allowing, flagging, or blocking it deterministically. (Scoring runs as a shadow-mode corroborating signal; it does not make the enforcement decision.)

Four Deployment Modes

MCP Gateway (Recommended)

Quint acts as an MCP proxy server between the agent and all downstream MCP servers.

Integration effort: Change one config value — point agent’s MCP server URL to quint-gateway.customer.com. 5-minute setup.

What’s intercepted:

MCP Method	Canonical Action
tools/list	mcp:server:list_tools
tools/call	mcp:{server}:{tool}.{verb}
resources/read	mcp:{server}:resource.read
prompts/get	mcp:{server}:prompt.get
notifications	mcp:server:notification

Tool poisoning detection: On every tools/list response, Quint hashes each tool’s description and parameter schema. If a hash changes, it triggers a mcp:server:tool.description_changed event at elevated risk.

Transport support: stdio (local servers) and Streamable HTTP (remote servers).

SDK Middleware

Native middleware for LangChain, CrewAI, AutoGen, OpenAI Agents SDK.

# LangChain — 3 lines
from quint import QuintMiddleware

quint = QuintMiddleware(api_key="qt_live_...", mode="enforce")
agent_with_quint = quint.wrap(agent)

# CrewAI
from quint import QuintCrewMiddleware

quint = QuintCrewMiddleware(api_key="qt_live_...")
crew = Crew(agents=[...], tasks=[...], middleware=[quint])

# OpenAI Agents SDK
from quint import QuintOpenAIMiddleware

quint = QuintOpenAIMiddleware(api_key="qt_live_...")
agent = Agent(name="support", tools=[...], hooks=quint.hooks())

Shadow mode (mode="monitor"): Scores everything, blocks nothing. Perfect for initial deployment.

Enforce mode (mode="enforce"): Actually blocks high-risk actions.

Integration effort: pip install quint-agent + 3-5 lines of code.

Forward Proxy

Quint acts as an HTTP/HTTPS forward proxy, intercepting all outbound AI traffic via MITM TLS.

Integration effort: Set HTTP_PROXY and HTTPS_PROXY env vars + trust Quint’s CA cert. 2-minute setup.

What’s intercepted:

Traffic Type	Action Format
HTTPS CONNECT tunnels	http:{domain}:{method}.{path}
POST to AI providers	Model extraction, body analysis
All outbound requests	Provider classification, scoring

Sub-agent detection: Quint monitors CONNECT tunnel patterns for model divergence, concurrency spikes, and temporal gaps to detect spawned sub-agents.

LLM parsing: 7 format parsers (Anthropic, OpenAI, OpenAI Responses, Bedrock Converse, Gemini, Azure OpenAI, Generic) extract tool calls with arguments from intercepted traffic.

Provider support: 46+ AI providers classified automatically from domain names — see Forward Proxy details.

API Event Stream

For custom architectures — send events directly to Quint’s API.

import quint

client = quint.Client(api_key="qt_live_...")

decision = client.evaluate(
    action="tool:database:query.execute",
    agent={"agent_id": "bot", "agent_type": "support"},
    target={"resource_id": "customers_db", "sensitivity_level": 3},
    data_fields_accessed=["email", "ssn"],
)

# "Model proposes, scope disposes": enforcement is deterministic scope
# evaluation. decision.risk_level is a shadow-mode corroborating signal,
# not the block decision — the block fires on an out-of-scope action
# against a sensitive resource.
if decision.out_of_scope and decision.target_sensitive:
    return f"Blocked: {decision.justification}"

Sync mode: Call before execution. Adds ~50ms latency. Can block.

Async mode: Fire events after execution. Zero latency. Monitor/alert only.

Integration effort: Higher — instrument each action point.

Onboarding Path

1. Week 1-2: Shadow Mode

   Proxy intercepts and scores everything but blocks nothing. Customer sees risk distribution in dashboard.

2. Week 3-4: Selective Enforcement

   Enable blocking for specific high-confidence rules: “Block all external data sends from the support bot.”

3. Week 5+: Full Enforcement

   Customer has tuned thresholds, created policies, and trusts scoring. Enable enforcement across all agents.

Latency Budget

Component	Target
Event capture + classification	< 2ms
Action canonicalization (compiler)	< 1ms
Scope evaluation (Gate 0.5, deterministic)	~1µs
Corroborating signals (shadow mode, off hot path)	< 35ms
Decision + forward/block	< 2ms
Total proxy overhead (p95)	< 45ms
With LLM fallback	< 3s

For context: a typical MCP tool call takes 100-500ms. Quint adds 10-30% overhead.

Data Privacy

What the proxy stores:

• Event metadata (action, agent, session, timestamps, scores)
• Data field classifications (“SSN was accessed”) but NOT field values
• Tool call parameters (sanitized — secrets redacted)

What the proxy does NOT store:

• Raw query results or API responses
• Actual PII values
• LLM conversation content
• User messages (only hashes for correlation)