The deterministic, local-first runtime control plane for autonomous coding agents. Intercept shell execution, contain filesystem paths, redact leaked secrets, enforce human approval gates, and chain tamper-proof SHA-256 audit logs before code runs on your host machine.
When an autonomous coding agent executes shell commands and writes to disk, relying on system prompts is mathematically unsafe against prompt injection, malicious repo files, or hallucinations.
System prompts asking the LLM: "Please do not delete user files, inspect .env, or push to git without asking".
../../etc/passwd) via symlinks, URL encoding, or
relative paths.
Every tool call, MCP stdio packet, and shell execution is intercepted outside the LLM context before it hits the operating system.
DENY > ASK > ALLOW.
Test how the deterministic engine inspects commands, evaluates risk scores, and resolves decisions.
Every agent operation and MCP tool call traverses all 14 stages in strict chronological order. No tool can bypass any step.
Enforces 10MB JSON-RPC message framing and 1MB argument caps to neutralize memory exhaustion & crash vectors.
Atomic pre-execution check against SQLite WAL. Instantly halts runaway agent sessions across CLI and Web UI.
Permanently quarantines malicious or altered MCP sources in SQLite. Blocks subsequent invocations immediately.
Restricts tool calls to 60 requests/minute per session to stop infinite recursive loops and rapid resource exhaustion.
Standardizes shell commands, strips privilege wrappers (sudo, env, bash -c), and normalizes package manager aliases.
Unicode NFC normalization, multi-pass URL decoding (%252e%252e), symlink resolution, and cross-drive isolation.
Calculates deterministic 0–100 CWE risk score. Detects tool schema mutations (rug-pulls) via SHA-256 fingerprints.
Mathematical additive specificity resolution. Strictest decision
always takes precedence: DENY > ASK > ALLOW.
Interactive confirmation prompt in terminal CLI or 1-click modal in the Web Operations Dashboard before execution.
Prevents time-of-check to time-of-use (TOCTOU) exploits. Revalidates action context hash, expiration timeouts, and kill switch.
Execution in bounded child process with strict 30-second timeout, memory bounds, and idempotency guarantees.
Automatic deep redaction for OpenAI, AWS, GitHub tokens, and private keys. Detects multi-step file exfiltration patterns.
Every event is cryptographically hashed with its predecessor into SQLite WAL. Detects any offline tampering or log deletion.
Automated security incident creation and live SSE broadcasting to operations dashboards and security teams.
Transparently sits between agent frameworks and the operating system with zero external cloud dependencies.
+-----------------------------------------------------------------------------------------+
| Autonomous AI Agent Runtime |
| (Claude Desktop / Cursor / Windsurf / Custom LangChain / AutoGPT) |
+-----------------------------------------------------------------------------------------+
|
[stdio / JSON-RPC / CLI / Programmatic SDK]
v
+-----------------------------------------------------------------------------------------+
| AGENT MONITOR RUNTIME CONTROL PLANE |
| |
| 1. Ingress Bounds --> 2. SQLite Kill Switch --> 3. Source Quarantine |
| 4. Rate Limiting --> 5. Canonicalization --> 6. RFC 8089 Path Containment |
| 7. CWE Risk Engine --> 8. Specificity AST --> 9. Human Approval Gate |
| |
| [ POLICY DECISION RESOLUTION ] |
| +--------------------+--------------------+ |
| | | | |
| [ DENY ] [ ASK ] [ ALLOW ] |
| (Halt & Log Event) (Wait for Human) (Proceed to Exec) |
| | | |
| +---------+----------+ |
| | |
| 10. TOCTOU Recheck |
| 11. Controlled Execution (30s timeout) |
| 12. Deep Secret Redaction |
| 13. SHA-256 Ledger Chaining |
| 14. Incident SSE Stream |
+-----------------------------------------------------------------------------------------+
| |
v v
+----------------------------------------+ +--------------------------------------------+
| Host Environment | | Local SQLite WAL |
| (OS Shell, Filesystem, Git) | | (.agent-monitor/agent-monitor.db) |
| - Contained within workspace | | - Cryptographic hash-chained events |
| - Stripped of leaked credentials | | - Auto-excluded from Git commits |
+----------------------------------------+ +--------------------------------------------+
Drop-in stdio proxy for Claude Desktop, Cursor, and Windsurf. Wraps untrusted MCP servers and sanitizes tool calls in real time.
Atomic circuit breaker backed by SQLite WAL. If an agent hallucinates or loops destructive commands, stop it immediately from CLI or Web UI.
Automated scanning and redaction of OpenAI, AWS, GitHub tokens, JWTs, and private SSH keys before command outputs reach the LLM.
Automatically registers .agent-monitor/ into
.git/info/exclude and .gitignore. Your
internal databases are never published to GitHub.
Genesis validation, exact sequence monotonicity, and SHA-256 recursive canonicalization guarantees audit trail tamper detection.
Lightweight embedded Next.js dashboard with live SSE streaming, visual file diffs, session history dropdown, and incident management.
Zero external daemons. Zero PostgreSQL or Redis required. Embedded SQLite WAL persistence out of the box.