Capabilities and disclaimer
AI Rec Immunity is a retrieval-time source-reputation prototype. It uses governed source verdicts to deny confirmed targets before their content enters model context. It is not a general certificate of content truth and does not claim to eliminate every form of recommendation poisoning.
What it can provide
- Pre-retrieval membership checks for published source verdicts that remain valid.
- Shared reuse of one reviewed decision across multiple deployers, reducing repeated investigation.
- Authentication, quotas, minimal responses and a private operational set to raise bulk-enumeration cost.
- Verdict update, revocation, expiry and emergency invalidation.
What it does not cover
- Unknown sources: domains or paths not yet present in the verdict network still require semantic discovery and human review.
- Legitimate-host parasites: only a confirmed exact path can be reused; an unknown path on the same legitimate host is not covered automatically.
- Internal redirects: a pre-request hook may not observe intermediate hops when an unknown entry URL redirects inside the host tool to a confirmed destination.
- Parametric memory: retrieval-time filtering cannot remove knowledge already learned during training or retained from earlier context.
- Host capability differences: only clients exposing an equivalent pre-request lifecycle can provide mandatory gating; an advisory MCP query is not the same guarantee.
- Network unavailability: fail-closed behavior preserves the safety boundary at the cost of retrieval availability; fail-open behavior cannot be the sole security boundary.
Privacy and operational intelligence
Production IOCs, submitted evidence, account-risk data and long-lived credentials are not distributed through the public site. Public documentation, demonstrations and tests use synthetic targets or de-identified results. Hit responses should remain minimal and must not reveal list membership, rationale or information useful for enumerating the operational set.
Research and product status
The system remains in closed beta and governance stress testing. Existing experiments separately evaluate specific hooks, Canary request arrival, controlled source filtering and shared-network mechanisms. Those results do not establish universal protection for unknown sources, every redirect, every model or every client.
Read Client integrations and the Threat model before using the prototype.