Built a zero-latency AST bouncer for local agent tool-calling

Hey everyone,

Like many of you, we got frustrated with the current state of safety guardrails for autonomous agents.

When you're running local LLMs (via Ollama, vLLM, or LM Studio) to execute bash scripts or database queries, calling a remote cloud moderation endpoint (Bedrock, OpenAI Moderation) defeats the entire purpose of running locally:

1. It adds 1,500ms–2,500ms of cloud latency to every single tool invocation.
2. It breaks the air-gap / local privacy guarantee.
3. LLM-as-a-judge evaluators are still susceptible to jailbreaks.

The Approach: Deterministic Compiler AST Invariants

Instead of asking another model if a proposed command is safe, we built an in-process Abstract Syntax Tree (AST) evaluator that parses Python, SQL, and Bash code blocks directly in caller memory before execution.

If an agent attempts:

• Catastrophic filesystem deletes (rm -rf, mkfs, raw device writes)
• Database DDL purges (DROP TABLE, TRUNCATE)
• Dynamic Python sandbox breakouts (().__class__.__base__.__subclasses__())
• Unauthorized reads of sensitive paths (/etc/shadow, .env, id_rsa)
• High-entropy credential exfiltration (AWS keys, OpenAI keys, GitHub PATs)

The tool execution is aborted in under 40 microseconds (<0.00004s) directly inside Python memory, with zero OS syscalls spawned.

Usage

It's published on PyPI as btp-guard:

bash
pip install btp-guard