Rahadian Bayu Permadi

perso is an embedded ABAC policy engine for MCP tool-call authorization — compiled to WebAssembly, with no control plane, no SaaS account, and no network call in the decision path. You define who can call which tools, under what conditions, in a plain JSON file. That file compiles into a single portable .wasm binary you load directly into your own process — a backend server, an MCP server, an edge function, or a CLI. There is nothing to deploy, register, or authenticate against. The policy engine ships inside your binary, next to your code, and answers Allow/Deny in-process, in microseconds. The LLM never touches auth. The host owns the role. perso makes the call at the point where the tool call would be forwarded — without leaving the process. perso is stateless and per-call by design: each decision evaluates one tool call against the attributes you pass in. For agentic loops — where the real risk often lives in a sequence of individually-innocent calls — the host or gateway accumulates session context and feeds it in as attributes; perso evaluates whatever context you give it, at microsecond cost per call. This isn't just asserted. perso-benchmark measures it directly: in-process WASM evaluation runs at ~1.75µs median, versus ~50.3µs for the same decision over a localhost network call to a PDP-style server — roughly 29× faster at the median, ~53× at p99. That's the best case for the network path (no TLS, no geographic distance, no multi-tenant queueing) — see the benchmark repo for full methodology, hardware specs, and raw results.