[heuristicolab]

Adds one bullet for Context Firewall (ctxfw) (Apache-2.0) to Tools > Open-source in 2-2-5-AI-Agent-and-MCP-Security.md, placed alphabetically between Cedar and Docker MCP Gateway per the section footnote:

• AI Agent and MCP Security (2-2-5-AI-Agent-and-MCP-Security.md), between Cedar and Docker MCP Gateway. ctxfw runs locally over stdio or loopback proxy with zero network egress to address four controls covered in this guideline:
  1. Prompt injection, tool poisoning & poisoned instruction files: scans untrusted MCP tool outputs and instruction files (CLAUDE.md / AGENTS.md) for imperative overrides and hidden bidirectional Trojan-Source Unicode characters (U+202A–U+202E, U+2066–U+2069).
  2. Policy-as-code for agent permissions: compiles project instruction files into deterministic path-traversal and command allowlists/denylists enforced before tool execution.
  3. Audit logging: records every MCP tool call and verification verdict in a local tamper-evident SHA-256 hash-chained SQLite WAL ledger (TraceKit).
  4. CI/CD diff gate: validates agent-generated diffs in pre-commit/CI (ctxfw gate).

Disclosure: I maintain ctxfw at Heurístico Lab. It is Apache-2.0 open-source software (PyPI, reproducible OWASP AISVS benchmarks). Happy to adjust or trim the wording if needed to fit the guideline's style.

Verified against .config/.markdown-lint.yml (MD004 dash list style, MD013 line length <= 1600, alphabetical ordering).