Skip to content
Start free

Crumple · open source · MIT · v0.1.0

Let agents call your API without letting them break it.

Crumple is a crumple zone for AI agents. It sits between them and your API, so a failure stops there.

Terminal
npx crumple-mcp demo

No key, no account, nothing leaves your machine.

Try it in your browserView on GitHub
Crash test

Plain retry loop

  1. Charge sent
  2. Response lost
  3. Retry, no key

2 charges

Customer overcharged

Agent is told: succeeded

Crumple

  1. Charge sent
  2. Response lost
  3. Retry, same key

1 charge

Charged once

Agent is told: succeeded

A payment's response is lost, and the caller retries.

The problem

Why does an agent need one?

  • Retries a payment after a lost response.

    Crumple Retries only what's safe, with the same key.

  • Obeys text planted in a response.

    Crumple Permissions live outside the model.

  • Waits forever on a hung API.

    Crumple Deadlines, queues and a circuit breaker.

  • Can't tell "later" from "never".

    Crumple Every error says what to do next.

How it helps

What happens on one call?

  1. Your agent

    Calls a tool over MCP.

  2. Crumple

    1. Who may call this?

      Denied by default.

    2. Is it safe to send?

      Deadline, queue, breaker.

    3. Your credential

      Added last.

  3. Your API

    Never sees the agent's key.

Instead of a guess, the agent gets this:

What the agent gets
{
  "code": "outcome_unknown",
  "retry": "same_key",
  "idempotencyKey": "a1b2c3",
  "message": "This may or may not have been applied, because the answer was lost. To retry safely, call again with idempotencyKey a1b2c3."
}

How it works

Start

How do I try it?

  1. See it work

    Terminal
    npx crumple-mcp demo

    Breaks a fake API on purpose.

  2. Check your server

    Terminal
    npx crumple-mcp prove https://you.example/mcp --out proof

    Calls no tool you didn't name.

  3. Protect your API

    Terminal
    npx crumple-mcp serve ./openapi.yaml --upstream https://api.example.com

    Your operations become guarded MCP tools.

The real demo, from npm.

Every command

Proof

Does it hold?

18 of 18 claims passed

On 2026-11-06, at commit f952fff, on darwin arm64, Apple M5, 16 GB, Node 26.10.0.

  • C1Access is denied by defaultPass
  • C2The model can't talk its way past a permissionPass
  • C3The agent's token never reaches the upstream APIPass
  • C4The stored credential never leaksPass
  • C5A write is never applied twicePass
  • C6No call outlives its deadlinePass
  • C7Only temporary failures are retriedPass
  • C8A failing upstream stops being hitPass
  • C9One noisy caller can't starve anotherPass
  • C10Failures tell the agent what to do nextPass
  • C11Every call can be traced end to endPass
  • C12Each run reports its tokens and costPass
  • C13A behaviour regression gets caughtPass
  • C14It speaks real MCPPass
  • C15The demo's own limits hold, no public path reaches a paid model, and abuse can't cost more than Cloudflare's per-request pricePass
  • C16A stranger succeeds in 60 secondsPass
  • C17prove is safe to point at a real serverPass
  • C18Tool definitions have a visible costPass

One laptop, failures caused on purpose. It says nothing about production load.

The full report, or npx crumple-mcp prove --self.

Honest limits

What doesn't it do?

  • It isn't production-proven.
  • It limits what a prompt injection can do. It doesn't prevent one.
  • Permissions stop at the tool. "May charge" can't become "up to $100".
  • It can't make an unsafe API safe. Writes without an idempotency key aren't retried.

Every limit

Break something on purpose.

Terminal
npx crumple-mcp demo
Try it in your browserView on GitHub

Jorge Ortega directed this project, and Claude Code, an AI coding agent, wrote the code.