A customs house for machine messages.
Two agent protocols. One governed crossing. ProtoBridge speaks Anthropic’s Model Context Protocol and Google’s Agent2Agent through a single pipeline — then inspects, redacts, or refuses every message that crosses, sealing each decision into a tamper-evident chain.
MCP — tools you host
JSON-RPC 2.0 over stdio. You spawned the process, so the question is “what tools do you have?”
and on the way back
A2A — agents you don’t own
JSON-RPC 2.0 over HTTP. A peer across a company boundary, so the question is “who are you?”
Watch a request get inspected.
Every trace below came out of the running system — a real MCP server in a subprocess and a real A2A agent over HTTP. None of it is mocked. Pick a crossing and follow it through the checkpoint.
Envelope in
Response out
Findings
Rules report facts. One function decides.
Checks are grouped by phase, not by protocol — because a PII leak is invisible on the way out. You only learn the response carried a national ID after the tool has already returned it.
| Code | Phase | Severity | Fires when |
|---|
Enforcement lives in a single function marked === POLICY SEAM ===. The default is
asymmetric: ingress is fail-closed, because nothing has left the building yet and blocking is cheap. Egress
redacts known PII fields; above-clearance content without known PII fields is blocked.
Verify the chain yourself.
Each entry hashes over the previous entry’s hash. Your browser recomputes all ten SHA-256 digests below with the Web Crypto API and compares them to what Python wrote. Break one and the damage propagates.
The chain covers a payload digest, never the payload — so the integrity proof survives even when policy required the sensitive bytes be dropped. You keep provability without retaining PII.