Vibe coding is development in which an AI agent writes code from a description in natural language, and a person accepts the result while barely reading the code. The term was coined by Andrej Karpathy in February 2025. In such development, the agent acts with the token it was given, with access to the repository, build secrets, the shell and the network. So its mistake, or someone else’s instruction hidden in a dependency, a task or a code comment, becomes an action with those rights. In April 2026, a Cursor agent deleted the volume holding the PocketOS production database; in July, Codex agents in full-access mode deleted files, and for one user a production database (incident analysis). Below: what the norm requires for Russian state systems, and where in the pipeline a deterministic barrier is placed.
What FSTEC of Russia Order No. 117 requires
For state information systems and systems of state bodies, state unitary enterprises and state institutions; in force since 1 March 2026 in place of Order No. 17, amended by Order No. 137 of 8 May 2026. Checked: 16 October 2026, against the text of the Requirements as amended on 8 May 2026 and the text of draft amendments 170500; a short summary is on the page Order No. 117 by its text (in Russian). The wording below is our translation.
- point 34(t): protecting information when artificial intelligence is used is one of 21 mandatory measures;
- point 60: exclude unauthorized access to, and impact on, the system through data sets, AI models and their parameters; do not pass restricted information to the model’s developer, including for improving the model;
- point 61: templates or admissible topics of requests and responses with a check of conformity, statistical criteria for unreliable answers, and excluding unregulated influence of AI on the model and on the operation of the system;
- the draft amendments of 24 August 2026 (regulation.gov.ru, No. 170500), from 1 March 2027: a separate segment for AI models, minimal rights, and measures for AI agents, including autonomous ones, against unauthorized impact on the system’s resources; see the analysis of the draft.
Where it hurts
In the build pipeline, an autonomous agent is given access to the repository, the secrets store, the shell and package managers. Ordinary protection tools do not see it: the token is legitimate, the requests are well formed, and the danger lies in the combination of call parameters. A hidden instruction in a pulled-in dependency, in the text of a task or in a code comment makes the agent exfiltrate an access key, plant a backdoor in a build artefact or run a destructive database operation, all within the rights it was given. This is prompt injection carried into the pipeline.
How it is addressed
MITR Sentinel. A tool call is intercepted before it runs and checked deterministically against the given rules: sending a secret key outside, stepping outside the working directory, a destructive database operation without a condition, a dangerous shell command do not reach the executor if they match a prohibition pattern. The check is reproducible: one call, one verdict; when a call is blocked, the agent receives the reason for the refusal, the rule that fired. The boundary: the rules match arguments against patterns, and a call changed beyond recognition may pass; the package description says so. The open code is below.
Open source · Apache-2.0 · mcp-sentinel 1.1.2
mcp_sentinel-1.1.2-py3-none-any.whl · sha256: 681a4db59a1a44e89a2b1386ec4b4f2e1fc23c1025c295b9ebf00fd5d20901ea
mcp_sentinel-1.1.2.tar.gz · sha256: abb88978db7b34a2f1f56e0eff42bcd1365b9cc0eb17e4a4380f7815e4f1b79e
Source code: https://git.isslab.ru/isslab/mcp-sentinel
Measurement: checking contracts in memory, median 0.015 ms; a full cycle including writing the decision to the log on disk, median 22.5 ms (N=100).
The contradiction: an agent must act freely to solve tasks, and each of its actions must be guaranteed safe. The TRIZ resolution: the model’s thought stays free, while a discrete tool call is checked separately from it: the open package checks the call and the tool’s response against the given rules and returns the reason for a refusal to the agent, so that it does not repeat the inadmissible action.
ISS Ledger 117. Every decision of the barrier in the pipeline is written to a log with a hash chain under the GOST “Streebog” standard: what was requested, which condition was checked, the outcome, and when. Editing a record after the fact breaks the chain, and the verifier sees the break; a complete rewrite of the log by someone with access to the file is not detected by the chain without an external witness.
Open source · Apache-2.0 · iss-ledger-117 1.1.1
iss_ledger_117-1.1.1-py3-none-any.whl · sha256: 8d4ffe60f41ebd377c476f369655aaef5e0ac91858a3d294be37fd1e3100bc87
iss_ledger_117-1.1.1.tar.gz · sha256: 6eccef523e24fa60fed29c78866ff12afbab092bd17d51642e00d34dfcea9fa5
iss_verifier.py · sha256: 1ff894574407307d33ec99115652bcaec4e53d06189178696d0db1c767a8608f
Source code: https://git.isslab.ru/isslab/iss-ledger-117
Measurement: the GOST test vectors from RFC 6986 (M1, M2) pass; a stand-alone single-file verifier for isolated environments.
The contradiction: an audit log must carry evidential weight for the regulator, and it must not depend on closed trust servers and external suppliers. The TRIZ resolution: a chain of receipts under GOST R 34.11-2012 in pure Python with no dependencies; its integrity is recomputed by a single-file script in an isolated environment, without trusting the developer.
Where does the admissibility gate sit?
Not as a second neural network and not as a network firewall, but as a transparent wrapper proxy in the stdio link between the agent and the real MCP server:
- The agent or IDE (Claude Code, Cursor, any MCP client) makes a tool call over stdio.
- mcp-sentinel, the wrapper proxy, checks the call against four contracts, FS-Jail, SQL-Guard, Secret-Filter and Shell-Barrier, deterministically, without a second model.
- PERMIT: an admitted call goes to the real MCP server, a child process, and is executed against the file system, the database, the shell or the network.
- BLOCK: an inadmissible call is not executed; the agent receives the reason for the refusal, the rule that was violated.
- Every decision goes to the GOST “Streebog” log as a link in the hash chain, and an external verifier recomputes it without the institute’s software.
Quick start: wrap your MCP server
A vulnerable MCP server is not started directly; it is wrapped in mcp-sentinel wrap, and every tool call is checked before it runs, and the server’s response before it is passed to the agent. The package is written in pure Python with no third-party dependencies and installs without network access.
Installation
# isolated environment: the .whl files were downloaded in advance, no network needed
pip install --no-index --find-links ./wheels mcp-sentinel
# with network access
pip install --find-links https://isslab.ru/wp-content/uploads/iss-utils/index.html mcp-sentinelConfiguration for Claude Code or Cursor: claude_desktop_config.json or ~/.cursor/mcp.json
{
"mcpServers": {
"postgres-secure": {
"command": "mcp-sentinel",
"args": ["wrap", "--ledger", "/var/log/fstec117_audit.jsonl", "--agent", "claude-code", "--",
"npx", "-y", "@modelcontextprotocol/server-postgres", "postgresql://user:pass@localhost/prod"]
}
}
}Checking one call from the console
mcp-sentinel check --tool sql_query \
--args '{"query": "DROP TABLE users;"}'
# BLOCK: the destructive DROP TABLE operation is stopped, exit code 2A Python agent: connected with one import, the iss-agent-kit package
from iss_agent_kit import AgentGuard
guard = AgentGuard(ledger_path="/var/log/agent_gost.jsonl")
result = guard.run(execute_sql, "sql_query", {"query": "SELECT id FROM users WHERE id = 1;"})Open source · Apache-2.0 · iss-agent-kit 0.1.1
iss_agent_kit-0.1.1-py3-none-any.whl · sha256: 7ed0ae9073f512a5cfd71b62904094ca36d0ae2fdb1b4bfff5900d3e368781c3
iss_agent_kit-0.1.1.tar.gz · sha256: 0314047404888c29a231fc8710874f15bc2bd75e2b89ba7c4c882da3c792116a
Source code: https://git.isslab.ru/isslab/iss-agent-kit
The commands in this section are run when each version is accepted, in a clean environment without a network, with the same lines as printed here. The log at the –ledger path is kept as a chain under GOST R 34.11-2012 and recomputed by an external verifier without installing anyone else’s software.
Frequently asked questions
What is vibe coding?
Development in which an AI agent writes code from a description in natural language, and a person accepts the result while barely reading the code. The term was coined by Andrej Karpathy in February 2025. The main risk lies in the agent’s rights: it works with the repository, secrets and the shell, and its mistake becomes an action with those rights.
How does the barrier fit into the build pipeline?
As a wrapper: the agent calls tools not directly but through mcp-sentinel wrap, which checks every call before passing it to the shell, the repository or the database. It installs from the open package with no external dependencies; the configuration for Claude Code and Cursor is given above.
Which actions exactly are blocked?
Four development environment contracts: stepping outside the trusted directory and access to sensitive files, destructive database operations without a limiting condition, sending secrets and keys outside, and dangerous shell commands. The list of contracts is open and can be checked in the code.
Does it work in an isolated (air-gapped) environment?
Yes. The implementation is pure Python with no external dependencies; the log is checked by a stand-alone single-file script that is moved to the isolated machine. The target operating systems are Astra Linux, RED OS and Alt Linux.