A customs house for machine messages.
Two agent protocols. One governed crossing. ProtoBridge speaks Anthropic’s Model Context Protocol and Google’s Agent2Agent through a single pipeline — then inspects, redacts, or refuses every message that crosses, sealing each decision into a tamper-evident chain.
MCP — tools you host
JSON-RPC 2.0 over stdio. You spawned the process, so the question is “what tools do you have?”
and on the way back
A2A — agents you don’t own
JSON-RPC 2.0 over HTTP. A peer across a company boundary, so the question is “who are you?”
Watch a request get inspected.
Every trace below came out of the running system — a real MCP server in a subprocess and a real A2A agent over HTTP. None of it is mocked. Pick a crossing and follow it through the checkpoint.
Envelope in
Response out
Findings
Rules report facts. One function decides.
Checks are grouped by phase, not by protocol — because a PII leak is invisible on the way out. You only learn the response carried a national ID after the tool has already returned it.
| Code | Phase | Severity | Fires when |
|---|
Enforcement lives in a single function marked === POLICY SEAM ===. The default is
asymmetric: ingress is fail-closed, because nothing has left the building yet and blocking is cheap. Egress
prefers redaction, because the expensive work is already paid for and the caller usually needs the rest.
Verify the chain yourself.
Each entry hashes over the previous entry’s hash. Your browser recomputes all ten SHA-256 digests below with the Web Crypto API and compares them to what Python wrote. Break one and the damage propagates.
The chain covers a payload digest, never the payload — so the integrity proof survives even when policy required the sensitive bytes be dropped. You keep provability without retaining PII.