Under your control
Open source · Apache-2.0

Safe to point at production.

The framework treats prompts, tool results and API responses as untrusted input. Nothing the LLM is told, shown or returns can change your infrastructure or widen its own access. You can deploy an agent today and then go to sleep.

Under the default policy, on every run
  • The LLM cannot induce a write.
  • The LLM cannot reach a host outside the target.
  • The LLM cannot obtain a credential.
  • The LLM cannot leave the sandbox.

The ceiling is a per-connector policy you set in configuration before the run. It ships read-only. The LLM never sees it and cannot move it.

I

Every request crosses the gate.

Authorization is complete mediation. It happens per request. A denial returns an error to the LLM and the loop continues.

Diagram 01 · request flow Request flow. The LLM proposes an operation and the required actions are resolved. The read-only policy either authorizes the call, in which case a credential is attached, the host is pinned and its IP verified, the request is sent, secrets are redacted from the response and an audit entry is written before the result returns to the LLM. Or it denies the call and returns an error to the LLM. READ-ONLY POLICY LLM proposes an operation Required actions resolved AUTHORIZED Credential attached Host pinned, IP verified Request sent Response SECRETS REDACTED Audit entry written JSONL · FAIL-CLOSED RESULT RETURNED TO THE LLM DENIED ERROR TO THE LLM · LOOP CONTINUES

Each step that proceeds is logged. If an audit entry cannot be recorded, the run aborts.

Configurable resource & cost controls
  • Config keyDefault
  • max_iterations32
  • max_subagent_iterations10
  • max_consecutive_failures5
  • sandbox concurrency16
  • sandbox timeout120s
  • max_total_tokens0 (unbounded)
II

Three trust boundaries.

Diagram 02 · trust boundaries Three trust boundaries, each crossed through the action gate. The LLM to the agent, the sandbox to the host, and the agent, which is trusted, to the provider. ACTION GATE UNTRUSTED INPUT LLM · untrusted input prompts, tool results and API responses 01 · LLM → AGENT Every call is authorized before a credential is attached UNTRUSTED CODE Sandbox · LLM-written code ephemeral process 02 · SANDBOX → HOST Exposed tools only. TRUSTED · THE FRAMEWORK Agent trusted · after authorization and host verification 03 · AGENT → PROVIDER Credential attached, host pinned, resolved IP verified

The LLM never holds credentials and never chooses the policy. It cannot move any of these boundaries.

III

Four principles.

Least privilege

The read-only policy is the ceiling for every run.

Fail closed

Anything not classified as legitimate is refused.

Complete mediation

Each call is authorized on its own.

Defense in depth

On AWS the boundary is enforced a second time by IAM, through an STS session scoped to SecurityAudit.

IV

Assurance.

Everything here is verifiable from the repository.

  • OpenSSF Best PracticesSilver.
  • Test coverage100% statement coverage, enforced in CI.
  • Race detectorRuns against the full test suite.
  • Static analysisCodeQL and gosec on every pull request.
  • Release integritySigstore keyless signatures bound to the release workflow, plus GitHub build attestations. macOS packages are signed, notarized and stapled.
  • DeploymentOne binary in your environment. Everything it reads stays there.
  • AccessRead-only by default. The ceiling is a per-connector policy set by the operator in configuration, never by the model.
  • TelemetryNone. The binary sends nothing anywhere.
  • LicenseApache-2.0.
V

Inside the data path.

Each run happens in your own environment. Your chosen LLM provider is the one external party in the data path, and you select it. When that provider is your cloud's managed inference in the same account, there is no external party at all.

What reaches the provider
  • The conversation
  • What a script console.logs
What doesn’t
  • Credentials
  • Raw tool results
  • Secrets

This page describes implemented controls. The full threat model is in the repository.

Threat model ↗ Architecture ↗ OpenSSF Best Practices ↗
Cynative