> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy Layer

> Full agent interception — MCP gateway, SDK middleware, API event stream

# Proxy Layer Architecture

The Quint Proxy is a transparent interception layer that wraps around an agent system. It captures every outbound action before it executes and checks it against the scope compiled from the agent's stated intent — allowing, flagging, or blocking it deterministically. (Scoring runs as a shadow-mode corroborating signal; it does not make the enforcement decision.)

## Four Deployment Modes

<Tabs>
  <Tab title="MCP Gateway (Recommended)" icon="plug">
    Quint acts as an MCP proxy server between the agent and all downstream MCP servers.

    ```mermaid theme={null}
    flowchart TD
    Agent["`Agent (MCP Client)`"] --> GW
    subgraph GW["`QUINT MCP GATEWAY`"]
        G1["`Intercepts tools/call`"]
        G2["`Scores each action`"]
        G3["`Detects desc changes`"]
        G4["`Allows/blocks`"]
    end
    GW --> Slack["`Slack MCP`"]
    GW --> Postgres["`Postgres MCP`"]
    GW --> GitHub["`GitHub MCP`"]
    ```

    **Integration effort:** Change one config value — point agent's MCP server URL to `quint-gateway.customer.com`. 5-minute setup.

    **What's intercepted:**

    | MCP Method       | Canonical Action             |
    | ---------------- | ---------------------------- |
    | `tools/list`     | `mcp:server:list_tools`      |
    | `tools/call`     | `mcp:{server}:{tool}.{verb}` |
    | `resources/read` | `mcp:{server}:resource.read` |
    | `prompts/get`    | `mcp:{server}:prompt.get`    |
    | `notifications`  | `mcp:server:notification`    |

    **Tool poisoning detection:** On every `tools/list` response, Quint hashes each tool's description and parameter schema. If a hash changes, it triggers a `mcp:server:tool.description_changed` event at elevated risk.

    **Transport support:** `stdio` (local servers) and `Streamable HTTP` (remote servers).
  </Tab>

  <Tab title="SDK Middleware" icon="code">
    Native middleware for LangChain, CrewAI, AutoGen, OpenAI Agents SDK.

    ```python theme={null}
    # LangChain — 3 lines
    from quint import QuintMiddleware

    quint = QuintMiddleware(api_key="qt_live_...", mode="enforce")
    agent_with_quint = quint.wrap(agent)
    ```

    ```python theme={null}
    # CrewAI
    from quint import QuintCrewMiddleware

    quint = QuintCrewMiddleware(api_key="qt_live_...")
    crew = Crew(agents=[...], tasks=[...], middleware=[quint])
    ```

    ```python theme={null}
    # OpenAI Agents SDK
    from quint import QuintOpenAIMiddleware

    quint = QuintOpenAIMiddleware(api_key="qt_live_...")
    agent = Agent(name="support", tools=[...], hooks=quint.hooks())
    ```

    **Shadow mode** (`mode="monitor"`): Scores everything, blocks nothing. Perfect for initial deployment.

    **Enforce mode** (`mode="enforce"`): Actually blocks high-risk actions.

    **Integration effort:** `pip install quint-agent` + 3-5 lines of code.
  </Tab>

  <Tab title="Forward Proxy" icon="shield-halved">
    Quint acts as an HTTP/HTTPS forward proxy, intercepting all outbound AI traffic via MITM TLS.

    ```mermaid theme={null}
    flowchart TD
    Agent["`AI Agent`"] -->|"CONNECT"| FP
    subgraph FP["`QUINT FORWARD PROXY`"]
        F1["`MITM TLS interception`"]
        F2["`Provider classification (46+)`"]
        F3["`LLM parsing (7 formats)`"]
        F4["`Tool call extraction`"]
        F5["`OnToolCall/OnEvent callbacks`"]
    end
    FP --> OpenAI["`OpenAI`"]
    FP --> Anthropic["`Anthropic`"]
    FP --> Google["`Google AI`"]
    ```

    **Integration effort:** Set `HTTP_PROXY` and `HTTPS_PROXY` env vars + trust Quint's CA cert. 2-minute setup.

    **What's intercepted:**

    | Traffic Type          | Action Format                    |
    | --------------------- | -------------------------------- |
    | HTTPS CONNECT tunnels | `http:{domain}:{method}.{path}`  |
    | POST to AI providers  | Model extraction, body analysis  |
    | All outbound requests | Provider classification, scoring |

    **Sub-agent detection:** Quint monitors CONNECT tunnel patterns for model divergence, concurrency spikes, and temporal gaps to detect spawned sub-agents.

    **LLM parsing:** 7 format parsers (Anthropic, OpenAI, OpenAI Responses, Bedrock Converse, Gemini, Azure OpenAI, Generic) extract tool calls with arguments from intercepted traffic.

    **Provider support:** 46+ AI providers classified automatically from domain names — see [Forward Proxy details](/edge/forward-proxy).
  </Tab>

  <Tab title="API Event Stream" icon="satellite-dish">
    For custom architectures — send events directly to Quint's API.

    ```python theme={null}
    import quint

    client = quint.Client(api_key="qt_live_...")

    decision = client.evaluate(
        action="tool:database:query.execute",
        agent={"agent_id": "bot", "agent_type": "support"},
        target={"resource_id": "customers_db", "sensitivity_level": 3},
        data_fields_accessed=["email", "ssn"],
    )

    # "Model proposes, scope disposes": enforcement is deterministic scope
    # evaluation. decision.risk_level is a shadow-mode corroborating signal,
    # not the block decision — the block fires on an out-of-scope action
    # against a sensitive resource.
    if decision.out_of_scope and decision.target_sensitive:
        return f"Blocked: {decision.justification}"
    ```

    **Sync mode:** Call before execution. Adds \~50ms latency. Can block.

    **Async mode:** Fire events after execution. Zero latency. Monitor/alert only.

    **Integration effort:** Higher — instrument each action point.
  </Tab>
</Tabs>

## Onboarding Path

<Steps>
  <Step title="Week 1-2: Shadow Mode">
    Proxy intercepts and scores everything but blocks nothing. Customer sees risk distribution in dashboard.
  </Step>

  <Step title="Week 3-4: Selective Enforcement">
    Enable blocking for specific high-confidence rules: "Block all external data sends from the support bot."
  </Step>

  <Step title="Week 5+: Full Enforcement">
    Customer has tuned thresholds, created policies, and trusts scoring. Enable enforcement across all agents.
  </Step>
</Steps>

## Latency Budget

| Component                                         | Target      |
| ------------------------------------------------- | ----------- |
| Event capture + classification                    | \< 2ms      |
| Action canonicalization (compiler)                | \< 1ms      |
| Scope evaluation (Gate 0.5, deterministic)        | \~1µs       |
| Corroborating signals (shadow mode, off hot path) | \< 35ms     |
| Decision + forward/block                          | \< 2ms      |
| **Total proxy overhead (p95)**                    | **\< 45ms** |
| With LLM fallback                                 | \< 3s       |

For context: a typical MCP tool call takes 100-500ms. Quint adds 10-30% overhead.

## Data Privacy

**What the proxy stores:**

* Event metadata (action, agent, session, timestamps, scores)
* Data field classifications ("SSN was accessed") but NOT field values
* Tool call parameters (sanitized — secrets redacted)

**What the proxy does NOT store:**

* Raw query results or API responses
* Actual PII values
* LLM conversation content
* User messages (only hashes for correlation)