MCP Visor is the production enforcement layer of a broader research program on governing autonomous agents at the boundary. The other two artifacts are deterministic prototypes. They are not shipping product, and they are not integrated into the Visor proxy.
MCP Visor does not align a model’s values, goals, or internal reasoning. It assumes the model may hallucinate, become compromised, follow malicious instructions, or act contrary to operator intent — then limits what it can actually do. That is applied AI safety and AI control, not classical alignment.
Architecture: Model proposes → Policy authorizes → Proxy enforces → Audit records. The Trust Plane thesis — that authorization must be re-evaluated when an agent materially increases its effective capabilities — is a research program. It is not a current Visor runtime claim.
Visor does not enforce arbitrary host filesystem, network, or non-MCP actions. Session taints and chains are in-memory and die on restart. Optional stdio identity pinning does not cover transitive imports, TOCTOU, or TPM/TEE. Roadmap language — protocol-agnostic adapters, distributed kill switch, signed capability artifacts — stays roadmap until it is built.