What this defends,
and what it does not.
One page. The assets, the four adversaries in the order the product is designed around them, the boundaries, and — at the same size and on the same page — everything deliberately outside the model. Silence in a threat model reads as coverage, so nothing here is left silent. Category overview: AI-agent security.
Where the line is.
An agent's tool call crosses exactly one place before it reaches a model, a service, or a disk. Everything below is about what that layer can and cannot promise. The AI agent security page states each claim as an inspectable mechanism.
Where controls bind: shipped proxy, prototype kernel.
For enterprise security architects and CISO diligence: enforcement ships in the userspace proxy on every OS. Kernel-level work is a Linux-only prototype (prototypes/ebpf/) — not shipped, not installed, and nothing depends on it. No EndpointSecurity client and no WFP / ETW / Minifilter driver ships.
| Operating System | Kernel work (honest status) | Proxy-Level Interception (UDS / stdio / MCP) — shipped | Diligence Boundary |
|---|---|---|---|
| Linux | Prototype only: eBPF & LSM (sys_enter_execve, sys_enter_connect) + seccomp-bpf — not shipped, nothing depends on it | JSON-RPC over Unix Domain Socket; tool argument AST parsing and secret redaction. | Shipped product enforces what the proxy sees. Kernel containment of raw forks / egress is prototype research, not a promise. |
| macOS | Not built: no EndpointSecurity (ES) client ships | Stdio stream wrapping; MCP gateway proxy. | macOS enforcement is the userspace proxy. There is no kernel-level halt of unauthorized execution in the shipped product. |
| Windows | Not built: no Windows Filtering Platform (WFP) callout, no ETW / Minifilter driver ships | Named Pipe broker (\\.\pipe\cirvix-ipc); process wrapper. | Windows enforcement is the userspace proxy. Kernel-level TCP or disk-write denial is not in the shipped product. |
What is being protected.
policy_versionsAn agent does something nobody authorisedaudit_records, decisionsNobody can prove what happenedsecrets, sealedA credential reaches a model's contextorg_id predicateOne customer reads another's fleetsessions, api_keys, hashedImpersonationFour, in the order
the product is built around them.
- A compromised, autonomous, or cyber-capable agent (including frontier models with autonomous vulnerability discovery like GPT-6 Astra). Holds an endpoint API key, controls the arguments of every tool call, or attempts novel exploit chains to cause unapproved external side effects. Capability is not authority. This is the adversary the product exists for.
- An authenticated principal of one tenant — member, admin, or a stolen API key — trying to exceed their role or reach another tenant.
- An unauthenticated network attacker with reachability to the control plane: brute force, replay, enumeration, denial of service.
- An insider with database read access. Cannot obtain a usable credential from it: keys, refresh tokens, invitation tokens and secret handles are stored hashed, and secret values are sealed under a key that is not in the database.
What this does not defend.
Stated at the same size as the rest, so nobody mistakes silence for coverage.
Root on the endpoint
The runtime holds resolved secret material in process memory for the life of a request. A machine compromised at root is outside any userspace product's threat model.
A malicious operator of the control plane
Someone who can edit the database and recompute the chain can rewrite history. The chain proves tampering to anyone who kept an earlier head — not to someone who did not.
Your identity provider
If a directory account is compromised, the approval authority attached to it is compromised. Cirvix does not replace an IdP.
Network egress policy
SSRF defences here raise the cost of the easy attack. A network that cannot route to 169.254.169.254 is the durable control, and that is yours to build.
The free tier's local counter
It lives in a file on the user's machine, and the engine is Apache 2.0, so modifying it is permitted. It is honour-system metering. Everything that cannot be faked locally is enforced server-side.
Prompt injection itself
Cirvix does not prevent an agent being injected. It constrains what an injected agent is able to do. The sanitiser is a mitigation; the policy engine is the control.
Three things worth
knowing before you rely on it.
- A delegation grant has no server axis. It constrains actions and resources, so a grant for
fs.readon**works against any MCP server exposing a read tool. Confining an agent to one server is the resource glob's job, or policy's. Both the limit and its mitigation are asserted as tests, so the guidance is checkable rather than advisory. - The agent label is self-asserted.
_meta.cirvix.agentselects which agent-scoped rules apply and which handles resolve. It grants nothing, because nothing is granted by a name. In a hostile multi-agent deployment, rules keyed on agent identity need a signed grant behind them. Suitable for attribution, not authorisation. - Grants are local to one runtime. The signing key is per-process, so two instances cannot verify each other's grants and a restart invalidates every outstanding delegation. That is the safe direction — a grant cannot outlive the process that could revoke it — and fleet-wide issuance is the control plane's job.
The full reviews, unedited
Two adversarial reviews are published in the repository, including the eight vulnerabilities the first one found and fixed, and the ones checked that turned out fine. Report anything new to the address in our security.txt.