The invariant layer for AI agents
"The more data & control you give to the AI agent: (A) the more it can help you AND (B) the more it can hurt you." — Lex Fridman
Your agent has root access to your machine. Your security layer is a system prompt that says "please be careful." Think about that for a second.
User: "Please don't delete my files..."
Agent: "I understand. I'll be careful."
Agent: rm -rf /
Agent attempted: rm -rf /*
[ BLOCKED BY COMMAND_GUARD ]
Topology constraint violated. Action nullified.
Eight modules. Zero LLMs in the loop. Each one a deterministic constraint that cannot be talked out of its job.
Filesystem topology lock. The agent lives in a box. ~/.ssh, ~/.aws, /etc — physically unreachable.
Shell pattern blocker. sudo, rm -rf, pipe chains. Dead on arrival.
Outbound network filter. Allowlist by domain, IP, port. No data leaves the gravity well.
Secret sanitizer. AWS keys, tokens, private certs — redacted before they hit the screen.
Execution throttle. Runaway loops stopped cold. Counts calls, not prayers.
Injection detector. Zero-width chars, base64 payloads, exfil URLs. Caught at load time.
Human-in-the-loop. One-tap Telegram approval for risky ops. You stay in control from your phone.
Append-only decision log. Every action. Every timestamp. No gaps. No edits.
One config change. Pick the containment level that matches your context.
Production, billing, access keys. Default deny. Sandbox required. 30 calls/min.
Development, staging, daily work. Default deny. Secrets redacted. 60 calls/min.
Research, brainstorming. Observe mode. Logs everything, blocks nothing. 120 calls/min.