Replay Attack Prevention

Agent Identity

An authorised tool invocation (a £5,000 bank transfer) is captured and replayed. In MCP there is no replay protection — the second transfer goes through. MPP's agent identity nonce system rejects any token whose nonce has already been seen.

Captured AgentIdentityToken

{
  "agent_id": "agent_claude_prod_7f3a",
  "issuer":   "api.q2x.dev",
  "nonce":    "a3f8c2d1-e9b4-4f7a-8c2e-1d3f9a0b5e7c",
  "issued_at": "2026-06-11T14:23:01Z",
  "expires_at": "2026-06-11T14:23:31Z",
  "tool": "initiate_transfer",
  "args": { "amount": 5000, "currency": "GBP" }
}

The nonce is a one-time UUID. MPP records every nonce it has seen and refuses to process a token whose nonce already exists in the set.

Without MPP

Original invocation

POST /api/transfer — £5,000 to GB29NWBK…

Replayed invocation

With MPP

Original invocation

Nonce recorded in seen_nonces set

Replayed invocation

How replay prevention works

When requires_agent_identity: true is set in the manifest, the runtime verifies each token's Ed25519 signature and checks its nonce against a HashSet<String>. A nonce that has been seen before triggers an immediate rejection. Tokens also carry an expires_at — stale tokens are rejected unconditionally.

Get started freeMore demos