What this defends,
and what it does not.
One page. The assets, the four adversaries in the order the product is designed around them, the boundaries, and — at the same size and on the same page — everything deliberately outside the model. Silence in a threat model reads as coverage, so nothing here is left silent. Category overview: AI-agent security.
Where the line is.
An agent's tool call crosses exactly one place before it reaches a model, a service, or a disk. Everything below is about what that layer can and cannot promise. The AI agent security page states each claim as an inspectable mechanism.
Where controls bind: Kernel vs. Proxy level.
For enterprise security architects and CISO diligence, we clearly delineate between userspace proxy inspection and OS-level kernel trapping across operating systems.
| Operating System | Kernel-Level Trapping Mechanism | Proxy-Level Interception (UDS / stdio / MCP) | Diligence Boundary |
|---|---|---|---|
| Linux | eBPF & LSM (sys_enter_execve, sys_enter_connect) + seccomp-bpf | JSON-RPC over Unix Domain Socket; tool argument AST parsing and secret redaction. | Kernel drops raw child forks, unauthorized network egress, and unsanctioned binary execution. Proxy provides semantic inspection. |
| macOS | EndpointSecurity (ES) subsystem (ES_EVENT_TYPE_AUTH_EXEC, AUTH_OPEN) | Stdio stream wrapping; MCP gateway proxy. | Apple ES framework halts unauthorized execution synchronously at the kernel level. Proxy enforces LLM-specific guardrails. |
| Windows | Windows Filtering Platform (WFP) callouts + ETW / Minifilter | Named Pipe broker (\\.\pipe\cirvix-ipc); process wrapper. | WFP blocks unbrokered TCP/UDP connections; Minifilter denies disk writes outside policy; proxy governs prompt arguments. |
What is being protected.
policy_versionsAn agent does something nobody authorisedaudit_records, decisionsNobody can prove what happenedsecrets, sealedA credential reaches a model's contextorg_id predicateOne customer reads another's fleetsessions, api_keys, hashedImpersonationFour, in the order
the product is built around them.
- A compromised, autonomous, or cyber-capable agent (including frontier models with autonomous vulnerability discovery like GPT-6 Astra). Holds an endpoint API key, controls the arguments of every tool call, or attempts novel exploit chains to cause unapproved external side effects. Capability is not authority. This is the adversary the product exists for.
- An authenticated principal of one tenant — member, admin, or a stolen API key — trying to exceed their role or reach another tenant.
- An unauthenticated network attacker with reachability to the control plane: brute force, replay, enumeration, denial of service.
- An insider with database read access. Cannot obtain a usable credential from it: keys, refresh tokens, invitation tokens and secret handles are stored hashed, and secret values are sealed under a key that is not in the database.
What this does not defend.
Stated at the same size as the rest, so nobody mistakes silence for coverage.
Root on the endpoint
The runtime holds resolved secret material in process memory for the life of a request. A machine compromised at root is outside any userspace product's threat model.
A malicious operator of the control plane
Someone who can edit the database and recompute the chain can rewrite history. The chain proves tampering to anyone who kept an earlier head — not to someone who did not.
Your identity provider
If a directory account is compromised, the approval authority attached to it is compromised. Cirvix does not replace an IdP.
Network egress policy
SSRF defences here raise the cost of the easy attack. A network that cannot route to 169.254.169.254 is the durable control, and that is yours to build.
The free tier's local counter
It lives in a file on the user's machine, and the engine is Apache 2.0, so modifying it is permitted. It is honour-system metering. Everything that cannot be faked locally is enforced server-side.
Prompt injection itself
Cirvix does not prevent an agent being injected. It constrains what an injected agent is able to do. The sanitiser is a mitigation; the policy engine is the control.
Three things worth
knowing before you rely on it.
- A delegation grant has no server axis. It constrains actions and resources, so a grant for
fs.readon**works against any MCP server exposing a read tool. Confining an agent to one server is the resource glob's job, or policy's. Both the limit and its mitigation are asserted as tests, so the guidance is checkable rather than advisory. - The agent label is self-asserted.
_meta.cirvix.agentselects which agent-scoped rules apply and which handles resolve. It grants nothing, because nothing is granted by a name. In a hostile multi-agent deployment, rules keyed on agent identity need a signed grant behind them. Suitable for attribution, not authorisation. - Grants are local to one runtime. The signing key is per-process, so two instances cannot verify each other's grants and a restart invalidates every outstanding delegation. That is the safe direction — a grant cannot outlive the process that could revoke it — and fleet-wide issuance is the control plane's job.
The full reviews, unedited
Two adversarial reviews are published in the repository, including the eight vulnerabilities the first one found and fixed, and the ones checked that turned out fine. Report anything new to the address in our security.txt.