DeadBolt

Contributing with an agent? Read AGENTS.md for setup, local checks and project boundaries.

A local execution gate for software agents. Put DeadBolt in the code that runs
an action, then let policy and operator controls decide whether that action runs.
Embed it in Rust, call its local sidecar from another language, or wrap a trusted
stdio MCP server. Free under Apache-2.0.

Install · Try it · Integrate · Migration · Project site

Recent evaluation evidence: ProtocolProbe's
read-only setup inspection and NextEleven's separate Swarm native integration
lab, with their tested scopes and remaining limits.

Version 2.0.1

This source targets engine 2.0.1 and Python client 2.0.1.post1. The Python
postrelease corrects documentation; its runtime modules are unchanged from 2.0.1.
The engine patch fixes MCP
spend sequencing on denied calls and requires independent admission for every
MCP tool invocation; the version 2 integration boundaries remain unchanged. Versioned releases
identify available downloads, exact source and checksums; installation
tracks package-manager, bundle and editor availability separately. A source merge
does not publish a package or update a directory listing.

Upgrading an existing install? Engine, Python client, editor plugins and
running sidecars are separate copies. Installing one does not upgrade the others.
Use the distribution status and upgrade checklist to
identify your route, verify its actual version and select the matching download.

Version 2 requires authenticated operator setup for Unix and TCP sidecars,
creates private state, defaults fresh roots to supervisor renewal, and enforces
ancestor policy and fixed run deadlines. Existing stored renewal modes remain
unchanged. Read major-version migration and
private state before replacing an older installation.

The artifact-pinned RC3 retest passed conflicting-destination denial, damaged-store
Cursor Reload refusal, and actual model calls after a fixed deadline on macOS
arm64. The underlying Auto model was unknown. Separate Linux headless checks
cover their recorded scope. These are execution receipts, not certification;
stable artifact and installed-consumer checks remain distinct from the RC3 results.

Try it before connecting an agent

No model account, API key, Harness, cloud service or database server is needed.
Choose a checksum-verified native archive in the installation guide.
From its extracted directory on macOS/Linux:

chmod 0755 deadbolt
./deadbolt --version
./deadbolt drill
python3 examples/evaluate.py --binary ./deadbolt

On Windows, use .\deadbolt.exe --version, .\deadbolt.exe drill and
python examples/evaluate.py --binary .\deadbolt.exe.
Expected: your selected version, deadbolt drill ok, and JSON with "passed": true.
The evaluation starts a private sidecar, writes harmless temporary files, checks
that policy, approval, kill and outage block effects, and cleans up afterward.
Python 3.9+ is the additional runtime needed. Understand the report.

For a reviewed source checkout, Rust 1.85+ and a native C compiler/linker:

cargo install --path . --locked --bin deadbolt
deadbolt --version
deadbolt drill

The matching Python client 2.0.1.post1 is published.
The matching Rust package 2.0.1 is also published.
Install the CLI from Cargo, or the Python client in your application environment:

cargo install n11-deadbolt --version 2.0.1 --locked --bin deadbolt
# In your application's virtual environment:
python -m pip install 'n11-deadbolt-client==2.0.1.post1'

For embedded Rust, use deadbolt = { package = "n11-deadbolt", version = "=2.0.1" }
and commit your application's own lockfile. The Python wheel contains the client,
not the engine. Node remains a bundled source module. Install and verify.

Pick your integration

Choose the exact bundle and matching configuration before installation. Blank
configuration exposes two read-only setup tools and provides no active protection.
Configured tools come from your trusted downstream server. Version 2 bundle runs
require a fixed deadline, deliberate renewal mode and reviewed offline exceptions.
The bundle uses broad one-shot tool approvals; it does not provision exact-action
grants. Configuration · Editor guide.

Download the current bundle from the explicit 2.0.1 release.
The official MCP Registry
now publishes 2.0.1 with the matching bundle checksum. Verify the entry's actual
version and checksum before installing. Discovery is not hosted operator access,
marketplace acceptance of another submission, or an endorsement.

Put the gate at the effect

Your trusted executor creates the run and configures policy first. With the
matching Python client installed and its sidecar configured:

from pathlib import Path
from deadbolt_client import dispatch

outcome = dispatch(
    "executor-run-001", "write_file",
    lambda: Path("output.txt").write_text("allowed work"),
)
if not outcome["executed"]:
    print("Action blocked:", outcome["decision"]["code"])

A fresh admission happens before the callback; a denial leaves the body uncalled.
Complete setup covers provisioning, policy, credentials,
transport and errors. Wrap every protected route. Never cache an allow or split
one-shot admission from execution. ensure confirms record presence, not liveness.

Controls and limits

• Tool and destination policies, reported-spend caps, pause, clips and operator kill.
• Default 60-second idle TTL. A separate supervisor maintains fresh runs; explicit
  activity mode is available. Neither mode can move a fixed deadline or revive
  expired/killed state. Liveness · Deadlines.
• Descendants obey ancestor restrictions. A child policy cannot widen its parent.
• Broad one-shot tool approvals and exact-action grants
  for trusted integrations using the content-bound API.
• Scoped admission credentials separate dispatch from
  operator controls. /spend remains operator-only.
• SQLite evidence, JSONL mirrors and per-agent incident exports.
• Store or transport failure denies protected dispatch; malformed or unsuccessful
  responses never authorize the body.

Ordinary trusted-executor admission treats unset policy lists as open; the MCP
proxy requires explicit tool policy. Configure runs and children before dispatch.
MCP discovery can advertise tools that the policy will deny. Destination parsing
covers recognized fields, not arbitrary arguments or network traffic.
Destination policy.

Know the boundary

DeadBolt protects connected execution routes. It does not sandbox arbitrary code,
stop a provider, or make external effects transactional with admission. Kill blocks
subsequent admissions; stopping in-flight work requires an executor cancellation
pattern. The MCP child remains trusted and has OS access; startup and non-tool
methods are outside the tool-call gate.

Keep state and operator authority outside untrusted agent processes. A process
able to write the database or invoke the operator CLI has operator authority;
socket credentials cannot contain it. Use separate OS/service ownership and OS
egress controls where your application requires those boundaries. Evidence hashes
identify content; operator-writable records are not tamper-proof certification.
Trust · HTTP authentication · Pilot checklist.

Developer documentation

Source checks: cargo test --locked, cargo clippy --all-targets --locked -- -D warnings,
and python3 tests/client_contract.py after cargo build --locked --bin deadbolt
(Python and Node required). CI also checks Rust 1.85, installed Python/SDK behavior
and native packages. Passing these checks does not establish acceptance of your application.

Report ordinary bugs
or use private security reporting. Copyright NextEleven LLC 2026.
License · Notice. Harness is one consumer, not a prerequisite.

For trusted executors that need to stop already running local commands, the
owned-process cancellation reference adds a
POSIX supervisor pattern with disposable acceptance. It does not
change the gate into a sandbox or add enforcement to older packages.