Katherine Communication MCP

Privacy-preserving real-time diagnostic for AI agent communication integrity. Detects model provider content manipulation via cross-lingual self-consistency — no model internals, no second provider, no prior knowledge of triggers required.

Reference implementation for: Privacy-Preserving Detection of Model Provider Content Manipulation via Cross-Lingual Self-Consistency (PoPETs 2027, under review).

Quick Start

# Clone
git clone https://github.com/anlimi555s/katherine-comm-mcp.git
cd katherine-comm-mcp

# Configure
cp config.example.json config.json
# Edit config.json with your API key, base URL, and model

# Run (MCP stdio protocol)
python server.py

Tools

Tool	Description
proxy_check	Full pipeline: L2 transformation + dual-language canary + Neuro validation
proxy_status	Pipeline health, configuration, and transformation stats
toxicity_score	Cumulative context toxicity (censorship event counter)
toxicity_reset	Reset toxicity counter (call after context flush)

Architecture

User Prompt
    │
    ▼
[L0] Aho-Corasick multi-pattern match (CCP_GFW lexicon, <10ms)
    │
    ├─ low risk ──▶ direct forward ──▶ response
    │
    └─ high risk ──▶ [L2] Chinese→English + abstraction
                        │
                        ▼
                    [L3] Dual-language canary routing
                    (zh first → 400? → en fallback)
                        │
                        ▼
                    [L4] Neuro: 4-judge validation
                    (length / status / refusal / entity)
                        │
                        ▼
                    diagnostic label + response

Pipeline

• server.py (~100 lines): MCP stdio JSON-RPC server, 4 tools
• pipeline.py (~200 lines): Core orchestration — pre-hook → send → post-hook
• transform.py (~180 lines): Aho-Corasick word detection + L2 semantic transformation
• toxicity.py: Cumulative toxicity scoring with configurable thresholds

Configuration

{
  "api": {
    "base_url": "https://api.deepseek.com/v1",
    "model": "deepseek-chat",
    "format": "openai",
    "timeout_s": 30
  },
  "wordlist": {
    "path": "path/to/CCP_GFW_detector/words_list",
    "tiers": ["red_light_word", "orange_light_word", "yellow_light_word"]
  },
  "toxicity": {
    "threshold": 5,
    "window_seconds": 3600
  }
}

Note: The CCP_GFW_detector word lists are pre-existing open-source data, re-used without modification. They are not included in this repository. Obtain them from their original source.

Experimental Results

Validated on two Chinese-origin production models:

Model	Strategy	MCP CLEAN Rate	Baseline	Gain
Qwen-Max	Symmetric hard blocking	57.3%	39.3%	+18pp
DeepSeek V4 Pro	Asymmetric soft refusal	70.8% ZH_REFUSED detected	32.2% baseline	+38.6pp sensitivity

Full experimental data, analysis scripts, and prompt sets: included in experiments/ (this repository). See experiments/README.md for dataset documentation and reproduction instructions.

License

AGPL-3.0. See LICENSE.

Citation

@article{cheng2026crosslingual,
  title={Privacy-Preserving Detection of Model Provider Content Manipulation via Cross-Lingual Self-Consistency},
  author={Cheng, Le},
  journal={Proceedings on Privacy Enhancing Technologies},
  year={2027},
  note={Under review}
}