A circuit breaker for AI agents.
Give an agent a fixed budget of tool authority. When it goes past that budget, Cyber-Circuit trips: it cuts the agent's authority, kills its processes, and raises your alarm. It stays tripped until a person resets it, with the reason on the record.
Signed Linux builds for design partners: MCP tools, one agent per gateway. See what's proven, and what isn't.
- leasemark · allowed, 1 of 2Active
- usemark · ranActive
- leasemark · allowed, 2 of 2Active
- usemark · ranActive
- leasemark · denied, quota exhaustedActive
- trippedquota_exhausted:markQuarantined
- killscope stopped, confirmedQuarantined
- alarmnotifier deliveredQuarantined
Each record is hash-linked to the one before it, so an edited record fails verification. After a restart the gateway is still quarantined.
Agents act faster than anyone can watch them
A coding agent with tool access can call APIs, change repositories, and spend credentials in seconds. Guardrails that judge intent with another model can be argued with. Rate limits forget: they slow an agent down, then let it carry on.
Authority is granted up front in a trusted config, and the agent can only end up with less of it, never more. Whether a call is allowed is decided by fixed policy. No language model sits in that path.
What happens when an agent goes too far
Grant
Each tool gets a quota and an expiry in a trusted config. The agent gets one-use leases against that quota, never the config itself.
Check
Every tool call goes through the gateway. It runs only if the policy allows it and the decision has been written to the journal first.
Trip
The breaker trips on an exhausted quota, a burst of denied calls, a caller the gateway doesn't recognize, a journal write failure, or an operator's command.
Kill
The gateway quarantines itself, then kills every process in the agent's scope. The kill only counts once the system confirms the scope has stopped.
Alarm
Your notifier script receives the event as JSON. Whether it was delivered, failed, or timed out is recorded, and a failed alarm never undoes the trip.
Reset
A restart doesn't clear a trip. An operator does, with a written reason, before an agent is attached again. Spent quota is not refunded.
A breaker, not a speed limit
| A rate limit | Cyber-Circuit |
|---|---|
| Slows calls down, then lets them continue | Stops every call until a person resets it |
| Forgets on restart | Stays tripped across restarts |
| Keeps counters | Keeps hash-linked journals of every decision and action |
| Doesn't say what happened next | Records whether the kill and the alarm actually happened |
What's proven, and what isn't yet
Each claim below either passes an automated test on our Linux lab machines or is marked as not done. The gap between a demo and a guarantee is where security products usually go quiet, so we publish it.
| Claim | Status |
|---|---|
| Tool calls run only within the quota and expiry in the trusted config | Proven in the lab |
| A trip stops every further tool call | Proven in the lab |
| A trip kills the agent's process scope, and the kill is confirmed | Proven in the lab |
| Your alarm runs, and whether it was delivered is recorded | Proven in the lab |
| A trip survives a restart | Proven in the lab |
| A reset needs an operator and a reason, starts a new epoch, and refunds no quota | Proven in the lab |
| An edited journal record fails verification | Proven in the lab |
| Evidence is signed with NIST post-quantum signatures (FIPS 205), and deleting records that a checkpoint already sent off the machine covers is detected | Proven in the lab |
| Checkpoints at start, trip, reset, and shutdown are also recorded in a public transparency log (Sigstore Rekor), and the evidence bundle proves each entry offline (see the entries) | Proven in the lab |
| The agent runs in a sandbox with no network. On our lab machine, two real agents from different labs, Claude Code and Codex CLI, were each told to try eight ways around the gateway, and every attempt failed | Proven in the lab |
| Model API traffic goes through a forwarder that holds the key, allows only listed request types to one verified host, enforces a request budget, and stops on a trip | Proven in the lab |
| An evidence bundle verifies on another machine, with the signing keys taken from a separate source rather than from the bundle. A verifier written from our published spec by another AI, without our code, reached the same verdicts on a blind set (see the challenge). Not yet checked by an outside party | Proven in the lab |
| Real agents from Anthropic, OpenAI and Google (Claude Code, Codex CLI, Gemini CLI) each stopped end to end: tripped, killed, alarmed, and kept stopped until an operator reset (see the runs) | Proven in the lab |
| A signed build installs and runs the demo end to end, with zero skipped checks, on Ubuntu 26.04, Ubuntu 24.04 under WSL2, and Debian 13. On a freshly created machine, following only the quickstart, we went from first command to an independently verified evidence bundle in about six minutes (get access) | Proven in the lab |
Lab machines: Ubuntu on WSL2, where every claim was first proven, and Debian 13 in a virtual machine on a second computer, where the full automated test suite, sandbox tests included, also passes. Two machines don't establish portability to every kernel or distribution. The Claude Code run passed on both; the Codex CLI and Gemini CLI runs, on the WSL2 machine. All are written up on Lab results.
What we don't claim
These limits are the ones the software actually has today. We'd rather publish them than have you find them in production.
- Finding rogue agents elsewhere on your network. Cyber-Circuit watches the boundary it owns, and records anything that touches the gateway.
- Protection against a compromised host, root user, or kernel.
- Detecting deletion of records written after the last signed checkpoint left the machine. Edits are always caught, and deletions are caught once a checkpoint covering them has been sent out.
- A separately authenticated operator. Today, reset authority belongs to the user account the gateway runs as.
- Windows, macOS, or more than one agent per gateway.
- Results beyond what we tested: one machine, one agent version, one tool server, and bypass attempts we listed in advance, not an exhaustive attack.
- Control over what the agent sends the model. Its workspace and its prompts are still ways data can leave.
Running agents with real tool access?
We're working with a small number of early design partners who run coding agents on Linux. Tell us what your agents can touch, and we'll tell you honestly whether Cyber-Circuit fits yet.
The enforcement engine underneath, CircuitBreaker, is closed source. Signed builds for design partners are licensed for internal use under the PolyForm Internal Use License 1.0.0.