Catch the Chain, Not Just the Call
A distributed exfiltration pattern — read a secret in call one, transmit it in call five — is invisible to anything that scores requests one at a time. Session Correlation links every invocation back to the request it came from, across the full session.
Four Ways to Link a Request
Not every MCP client sends the same correlation signal. The correlation engine layers four independent strategies so a session is tracked even when one signal is missing.
Explicit IDs
Reads trace_id, session_id, conversation_id and other _meta fields the client already sends — the strongest signal when it's present.
Standard Headers
W3C Trace Context (traceparent), X-Correlation-ID, and the MCP Mcp-Session-Id header — interoperable with existing distributed tracing.
Temporal Window
Groups requests from the same agent within a rolling time window (default 5 minutes), optionally requiring a matching client IP, above a minimum confidence threshold.
Semantic Data Flow
Caches distinctive values seen in a response and watches for them reappearing in a later request's parameters — the signal that catches "read here, send there" exfiltration regardless of timing.
Why Single-Call Scanning Misses This
A prompt injection scanner, a policy engine, and a DLP filter all evaluate one request at a time. An agent that reads a credential from a config tool in call one and posts it to an external webhook tool five calls later never trips a per-call check — each call looks legitimate in isolation.
Correlation closes that gap by reconstructing the session as a graph of linked calls, so a policy or trust boundary rule can reason about the whole chain — not just the request in front of it.
Same agent, same session, five calls apart — correlation is what turns two unrelated-looking events into one flagged data-exfiltration chain.
Tunable Per Tenant
Every strategy can be toggled and tuned independently — turn off temporal correlation for a low-traffic tenant, tighten semantic confidence for a high-security one, or require IP matching where session hijacking is a concern.
Confidence thresholds
Temporal and semantic correlation each carry their own minimum-confidence setting, so low-signal matches don't get treated the same as a strong explicit ID.
Semantic cache limits
Cached response values expire on a configurable TTL and are capped per session, with a minimum value length and an exclude list for noisy common values.
Posture-tracked
Risk Posture flags a tenant still running the out-of-the-box defaults, so customizing correlation for your traffic pattern is visible in your security score.
See the Whole Session, Not Just One Call
Get correlation-aware threat detection across every step of your agents' MCP sessions.
Join the Waitlist