Mcp misbehaviour plugin

[ebursztein]

Args changes
Excessive return size

[Saurav-Gupta-9741]

Hi @ebursztein Sir, I would love to take this on!

I have extensive experience building deterministic AI Guardrails (I recently architected the OS-level Guardrail Interceptor for Microsoft AutoGen to block malicious terminal commands, which is currently pending final approval/merge from their core team).

To ensure this McpMisbehaviourPlugin is optimally performant with zero overhead, here is my proposed architecture for the two vectors:

1. "Args changes" (Deep Mutation Detection): Instead of basic schema validation, the most optimal solution is to implement a structural diff/hash comparison. The plugin will capture the original arguments requested by the LLM, and do a deep comparison against the final arguments attempting to be executed by the MCP tool. If any intermediary layers or injection attacks have dynamically mutated the payload (changed parameters, altered types, or appended hidden strings), the plugin will instantly flag the deviation as misbehavior.

2. "Excessive return size" (Optimized Stream Interception): To prevent OOM crashes or context-window overflows, we cannot wait for the payload to load into memory. First, the plugin will inspect the metadata/Content-Length headers (if available) to instantly reject oversized payloads with O(1) complexity. For chunked/streamed responses, I will wrap the response in a byte-counting proxy. The exact millisecond the byte threshold (max_payload_bytes) is breached, the stream is aborted, preventing any DoS vectors.

Let me know if this highly optimized architecture aligns with your vision for capsem. I am ready to begin the PR whenever you give the green light!