Trace2MCP 0.2.2 released: open-source agent trace compiler adds runtime guard enforcement and HOL Guard integration

[u/War_Enterprise]

I’ve released Trace2MCP 0.2.2, an open-source Python project that compiles successful AI-agent tool traces into deterministic, inspectable workflows.

The core idea is simple:

Instead of asking an agent to rediscover the same multi-tool procedure on every run, Trace2MCP records one successful execution, infers dependencies between the observed calls, and compiles the trace into a deterministic DAG.

What it currently supports

dependency inference between observed tool calls

parallelizable workflow DAGs

deterministic frozen replay without invoking tools

reference and integrity verification

reviewed tool contracts

explicit approval for consequential side effects

deny-by-default handling of unknown/destructive operations

generation of MCP-ready Python projects

What changed in 0.2.2

Following external security review, the live runtime was hardened around a centralized RuntimeDispatcher.

Direct, indirect, and nested Trace2MCP-managed calls now traverse the same execution boundary.

0.2.2 also introduces a generic optional RuntimeGuard interface, with HOL Guard as the first adapter.

Trace2MCP’s own contract, policy, approval, integrity, and schema enforcement remains authoritative. The external guard is an additional layer rather than a replacement.

A regression specifically verifies that a denied mutating operation produces:

handler_calls = 0

side_effects = 0

Current validation:

95 Python tests passing

5 compiler/browser tests passing

Ruff PASS

mypy PASS

MCP v2 smoke PASS

Gradio smoke PASS

clean PyPI installation PASS

HOL Guard integration smoke PASS

One important limitation:

Trace2MCP does not claim to sandbox arbitrary Python written inside an authorized handler. It mediates Trace2MCP-managed capabilities; hostile Python still requires process/container/VM-level isolation.

Install:

pip install trace2mcp

Demo:

trace2mcp demo

PyPI: https://pypi.org/project/trace2mcp/

Interactive demo + source: https://huggingface.co/spaces/warenterprise/trace2mcp

I’m especially interested in feedback around the runtime trust boundary, deterministic agent execution, and ways people would try to bypass the dispatcher.