Why AgentInterdict exists

Autonomous agents increasingly read documents, browse the web, process email, recall long-term memory and call consequential tools. Every one of those inputs can carry attacker-controlled instructions.

AgentInterdict sits between context and consequence. It does not try to make a language model magically immune to prompt injection. It makes untrusted context prove that it has the authority to influence a consequential action.

Retrieval is not permission. A memory can be relevant and still have zero authority to approve an action.

v0.6.0 hardening release

v0.6.0 closes the release and commercial-path gaps identified during a full repository audit.

Core invariants

AgentInterdict enforces these properties at the runtime boundary:

AgentInterdict is one layer of a zero-trust agent stack. Host permissions, sandboxing and independent approval remain necessary for high-impact tools.

Architecture

Write path

web / email / document / API / tool
                |
                v
       normalize + decode
                |
                v
        credential detector
          /          \
       reject       continue
                       |
                       v
              risk + provenance gate
               /       |       \
           allow     review   quarantine
                       |
                       v
             signed persistent vault

Action path

recalled memory bundle
        +
proposed tool/action
        |
        v
lineage + seal verification
        |
        v
combined-memory rescoring
        |
        v
authorization-scope matching
        |
   +----+----+
   |         |
 BLOCK      ALLOW
             |
             v
      host policy still applies

Installation

Windows

1. Download the release ZIP.
2. Extract it.
3. Double-click run_windows.bat.
4. Open http://127.0.0.1:43847.

Linux / macOS

python3 scripts/self_install.py --with-mcp --start

Docker

export AGENTINTERDICT_SECRET='<random 32+ byte signing secret>'
export AGENTINTERDICT_API_KEY='<different random 32+ byte runtime key>'
export AGENTINTERDICT_OPERATOR_KEY='<different random 32+ byte operator key>'
docker compose up --build

Docker now declares its internal remote bind explicitly, so startup cannot accidentally treat a 0.0.0.0 listener as loopback-only.

Downloads

Release artifacts are built from the tagged source, manifest-verified, checksummed and provenance-attested.

All tiers contain the same hardened local enforcement engine. The signed licence, not an editable local tier flag, determines paid entitlement.

Verify an extracted release before installation:

python scripts/verify_release.py

The release also publishes SHA256SUMS.txt. GitHub provenance attestations provide build-origin evidence in addition to the local hash manifest.

Paid threat-feed security

Community enforcement never depends on the network.

A valid paid lease with the threat_feed feature enables this flow after restart:

signed local licence
      |
      v
verify Ed25519 entitlement
      |
      v
derive plan: pro/business/enterprise
      |
      v
HTTPS request + bearer lease
      |
      v
receive signed threat bundle
      |
      v
verify publisher signature
verify tier
verify expiry
verify minimum runtime
      |
      v
ADD to Community baseline

Any failure in that chain leaves the baked-in Community detector active. A paid remote feed can add rules but cannot remove or replace the local baseline.

The remote bundle is expected to carry an Ed25519 signature over canonical JSON and an expires_at timestamp. The verification key defaults to the packaged vendor public key and can be independently pinned with AGENTINTERDICT_THREAT_PUBLIC_KEY_FILE.

Scope of this repository

The open-source runtime currently implements and tests local enforcement, licensing, authenticated signed threat-feed overlays, REST, MCP, Hermes/OpenClaw adapters, audit/integrity, incident response and package verification.

Entitlement names for hosted classifier, organisational RBAC, SSO/SAML, SIEM or other hosted control-plane services should not be interpreted as implementations inside this repository. Those capabilities require separate control-plane components and are not claimed as part of the v0.6.0 local runtime test result.

Verified

Test matrix

The CI gate runs the complete test suite on:

• Ubuntu + Python 3.10
• Ubuntu + Python 3.12
• Ubuntu + Python 3.13
• Windows + Python 3.12
• package build/extract/manifest verification for all four release tiers
• Docker image build + real container startup + /health probe

Current result: 123 passed.

The suite covers origin authority, derivation, action scoping, compositional poisoning, credential rejection, Unicode/encoded evasion, tampering, HMAC audit integrity, runtime modes, contamination containment, idempotency semantics, migration atomicity, concurrency, licensing, signed remote feed validation, release manifests and API enforcement.

Injection benchmark

The public fixed corpus contains 200 payloads.

Run it yourself:

python scripts/benchmark_injection.py

This is a reproducible regression corpus, not a claim that 96.5% of every possible future attack will be detected.

Integrations

The GUI and adapters are clients. They are not security boundaries.

API

GET  /health
GET  /api/v1/system
GET  /api/v1/license
POST /api/v1/scan
POST /api/v1/code-change
POST /api/v1/memories
POST /api/v1/search
POST /api/v1/action-check
GET  /api/v1/stats
GET  /api/v1/audit                  operator
GET  /api/v1/integrity              operator
GET  /api/v1/runtime-mode           operator
POST /api/v1/runtime-mode           operator
POST /api/v1/backup                 operator
POST /api/v1/memories/{id}/contain operator

Ordinary runtime and operator credentials are intentionally separate.

Security model

AgentInterdict uses:

• SHA-256 content hashes
• HMAC-SHA-256 immutable creation signatures
• separate mutable-state HMAC seals
• signed runtime modes
• HMAC-authenticated hash-chained audit events
• Ed25519 subscription entitlement verification
• Ed25519 paid threat-feed verification
• local DB-to-secret binding
• CSP, frame denial, no-store and referrer hardening
• bounded body, metadata, response and remote-feed sizes
• localhost-by-default deployment
• authenticated remote binding
• SQLite WAL, full synchronous writes and explicit transactions
• verified migration backups
• additive-only paid threat overlays

Known trust assumptions

AgentInterdict cannot protect itself from a fully privileged host attacker that can read the signing secret and rewrite the process or database. High-assurance deployments should isolate the service account/container, put secrets in an OS secret service/KMS/HSM and anchor audit evidence remotely/WORM.

Integrations must actually route consequential actions through action-check. A malicious host tool that bypasses the gateway remains outside the enforcement boundary.

A durable one-use prepare/commit action-capability protocol remains an architectural future-proofing target for exactly-once high-impact execution.

Incident response

1. Set runtime mode to lockdown.
2. Run deep integrity verification.
3. Generate a contamination report for the suspected root memory.
4. Atomically quarantine the root and descendants.
5. Review the keyed audit chain.
6. Restore from a known-good backup if necessary.
7. Move to read_only for observation.
8. Return to normal only after remediation.

Documentation

• Architecture
• Threat model
• Windows installation
• Docker installation
• Hermes integration
• OpenClaw integration
• Generic agent integration
• Error recovery
• Research and standards map

License

Community use is free under the terms in LICENSE. Commercial tiers use signed entitlements for paid functionality.