Most MCP guards lead with content scanning, matching payloads against injection signatures. Some also do taint tracking (pipelock does both). Customhouse only does provenance. It never inspects content at all.
You mark each upstream server trusted or untrusted (leave it out and it's untrusted, so forgetting fails safe). Once a session gets a result from an untrusted server, calls that move money or send data out are refused for the rest of that session. No model in the decision path, no pattern matching, so rewording or base64-ing the payload doesn't help.