Secure tunnel access to locally executed tools for artificial intelligence agents
Systems are disclosed for enabling artificial intelligence (“AI”) agents to securely access client-hosted Model Context Protocol (“MCP”) servers over cloud-managed connections. A cloud connector executing at a client authenticates with a connection server of an AI platform to establish a secure tunnel. A platform-based AI agent can transmit resource commands over the secure tunnel to the client-based MCP server and receive corresponding outputs. The outputs are processed with guardrails configured to detect prompt injection, confidential content, or personally identifiable information, and modified results are utilized during execution of other agent objects, such as AI models, vector databases, datasets, or scripts. Resource commands may also be logged and modified before execution, while redundant tunnels ensure reliability. This architecture provides enterprises with a secure, auditable, and policy-compliant mechanism for extending cloud-based AI agents to leverage client-hosted tools and resources without exposing inbound network vulnerabilities.
1 . A method for artificial intelligence (“AI”) agents to utilize remotely hosted tools over secure cloud connections, comprising:
downloading, at a remote device, a cloud connector installer from an AI platform, wherein the AI platform executes an AI agent, and wherein the cloud connector installer causes a cloud connector to install at the remote device;
transmitting an authentication request from the cloud connector to a connection server of the AI platform, invoking a first secure tunnel between the AI platform and the remote device without opening a firewall port at the remote device;
receiving, from the connection server over the first secure tunnel, a request to initialize a server-sent event (“SSE”) channel with a model context protocol (“MCP”) server at the remote device;
instantiating, at the remote device, a nano sandbox based on a definition extracted from the request, wherein the nano sandbox comprises an isolated execution environment in a kernel, wherein the definition specifies a runtime environment of the nano sandbox;
initiating execution of the MCP server within the nano sandbox;
transmitting, to the connection server of the AI platform, a session identifier;
receiving, from the connection server of the AI platform, a resource command and the session identifier;
transmitting the resource command to the nano sandbox based on the session identifier;
receiving a resource output of the MCP server in the nano sandbox; and
transmitting a response over the SSE channel to the connection server of the AI platform, wherein the response is the resource output or a modified version of the resource output.
2 . The method of claim 1 , wherein the remote device comprises a user device.
3 . The method of claim 1 , wherein the remote device comprises a server on premises of a customer of the AI platform.
4 . The method of claim 1 , further comprising utilizing the first secure tunnel to stream messages from the MCP server to the connection server in an instance in which the MCP server utilizes SSE transport.
5 . The method of claim 1 , wherein the first secure tunnel includes end-to-end encryption of traffic sent over the first secure tunnel.
6 . The method of claim 1 , wherein the first secure tunnel is opened without inbound ports at the remote device.
7 . The method of claim 1 , further comprising:
transmitting a tool specification over the first secure tunnel, the tool specification describing a tool available to the MCP server,
wherein the resource command is specified by the tool specification.
8 . The method of claim 1 , wherein the session identifier identifies the nano sandbox at the remote device where the MCP server executes.
9 . The method of claim 1 , wherein the definition specifies system resources to include in the nano sandbox.
10 . The method of claim 1 , wherein the connection server comprises an MCP client that interacts with the MCP server over the SSE channel.
11 . The method of claim 10 , wherein the resource command utilizes standard input/output (“STDIO”) transport.
12 . The method of claim 10 , wherein the resource command utilizes SSE transport.
13 . The method of claim 1 , further comprising modifying the resource command with guardrails, wherein the guardrails are configured to detect at least one of malicious code and personally identifiable information (“PII”).
14 . The method of claim 1 , further comprising logging the resource command.
15 . The method of claim 1 , wherein the MCP server at the remote device is specified by an agent object of the AI agent.
16 . The method of claim 1 , further comprising opening a second secure tunnel with a second cloud connector that executes at the remote device, wherein the first secure tunnel and the second secure tunnel are utilized for accessing different MCP servers at the remote device.
17 . The method of claim 1 , wherein nano sandbox is instantiated using a bubblewrap command that restricts file system access to one or more specified directories.
18 . The method of claim 1 , further comprising:
pinging the nano sandbox, wherein the nano sandbox returns the ping when the MCP server is initialized; and
based on detecting the returned ping, transmitting the session identifier to the connection server.
19 . A non-transitory, computer-readable medium containing instructions for artificial intelligence (“AI”) agents to utilize remotely hosted tools over secure cloud connections, wherein the instructions are executed by at least one processor to perform stages comprising:
downloading, at a remote device, a cloud connector installer from an AI platform, wherein the AI platform executes an AI agent, and wherein the cloud connector installer causes a cloud connector to install at the remote device;
transmitting an authentication request from the cloud connector to a connection server of the AI platform, invoking a first secure tunnel between the AI platform and the remote device without opening a firewall port at the remote device;
receiving, from the connection server over the first secure tunnel, a request to initialize a server-sent event (“SSE”) channel with a model context protocol (“MCP”) server at the remote device;
instantiating, at the remote device, a nano sandbox based on a definition extracted from the request, wherein the nano sandbox comprises an isolated execution environment in a kernel, wherein the definition specifies a runtime environment of the nano sandbox;
initiating execution of the MCP server within the nano sandbox;
transmitting, to the connection server of the AI platform, a session identifier;
receiving, from the connection server of the AI platform, a resource command and the session identifier;
transmitting the resource command to the nano sandbox based on the session identifier;
receiving a resource output of the MCP server in the nano sandbox; and
transmitting a response over the SSE channel to the connection server of the AI platform, wherein the response is the resource output or a modified version of the resource output.
20 . A system for artificial intelligence (“AI”) agents to utilize client-hosted tools over secure cloud connections, the system comprising:
at least one physical non-transitory, computer-readable medium comprising instructions; and
at least one processor that executes the instructions to perform stages comprising:
downloading, at a remote device, a cloud connector installer from an AI platform, wherein the AI platform executes an AI agent, and wherein the cloud connector installer causes a cloud connector to install at the remote device;
transmitting an authentication request from the cloud connector to a connection server of the AI platform, invoking a first secure tunnel between the AI platform and the remote device without opening a firewall port at the remote device;
receiving, from the connection server over the first secure tunnel, a request to initialize a server-sent event (“SSE”) channel with a model context protocol (“MCP”) server at the remote device;
instantiating, at the remote device, a nano sandbox based on a definition extracted from the request, wherein the nano sandbox comprises an isolated execution environment in a kernel, wherein the definition specifies a runtime environment of the nano sandbox;
initiating execution of the MCP server within the nano sandbox;
transmitting, to the connection server of the AI platform, a session identifier;
receiving, from the connection server of the AI platform, a resource command and the session identifier;
transmitting the resource command to the nano sandbox based on the session identifier;
receiving a resource output of the MCP server in the nano sandbox; and
transmitting a response over the SSE channel to the connection server of the AI platform, wherein the response is the resource output or a modified version of the resource output.