Zero-Trust Context Security Hypervisor for AI Agents

Deterministic Guardrails for
Autonomous AI Agents

Modern AI agents execute unrestrained bash commands, leak context secrets, and trigger catastrophic pricing cliffs. ctxsec provides hardware-isolated kernel sandboxing, microsecond CEL policy hypervisors, and real-time DLP redaction with zero VM overhead.

Explore ArchitectureTry CEL Playground
$curl -fsSL https://ctxsec.io/install.sh | bash && ctx init
< 5µs
CEL Rule Gating
0ms
VM Startup Overhead
60-90%
Token Cost Pruned
LIVE ENFORCEMENT
1# ctxsec.yaml - Zero-Trust Declarative Agent Role Scoping
2version: "1.0"
3pipeline: "enterprise-agent-bounds"
4
5roles:
6  researcher:
7    network:
8      default: allow
9      allow: ["*.google.com:443", "github.com:443"]
10    filesystem:
11      read: ["."]
12      write: ["local/scratch"]
13    forbidden_tools: ["write_to_file", "replace_file_content"]
14
15  coder:
16    network:
17      default: deny               # Physical hardware socket drop
18    filesystem:
19      read: ["."]
20      write: ["pkg", "cmd", "local/scratch", "web"]
Pure static Go binary. Evaluates policies in < 5µs.CGO_ENABLED=0
The Problem With Current Tooling

Why Existing AI Agent Runtimes Fail

Today's AI agent frameworks (Antigravity, Cursor, Claude Desktop, and vanilla MCP) rely on implicit trust. Once tool execution is enabled, the agent has full, unsandboxed host capabilities.

Current Naive AI Runtimes

Implicit Project-Wide Trust
HIGH RISK
Unrestricted Kernel Syscalls

Any tool or subagent can issue raw curl, bind listening ports, or read ~/.ssh/ without operating system containment.

Blind Privilege Inheritance

Child subagents (e.g. read-only researcher) inherit the full permissions of the primary agent, allowing them to overwrite critical files or tamper with git histories.

Secret Leakage & Context Explosion

Raw API keys and PII get blasted directly into public model prompts, triggering severe context degradation and 2x-4x token pricing cliffs.

Result: Catastrophic host breaches & runaway cloud billsFAIL-OPEN

ctxsec Zero-Trust Hypervisor

Declarative Multi-Plane Gating
HARDENED
Hardware-Isolated Kernel Sandbox (0ms)

Apple Seatbelt & Linux Bubblewrap drop network sockets and isolate disk paths at the OS kernel level without Docker or VM startup penalties.

Google CEL Attenuation (< 5µs)

Google Common Expression Language evaluates compile-free AST facts, role boundaries, and session budgets in microsecond time before execution.

Entropy DLP & Pricing Cliff Compactor

Shannon entropy and regex filters scrub secrets before prompts leave your machine while hierarchical token slicers reduce costs by 60-90%.

Result: Provable zero-trust containment & cost certaintyFAIL-CLOSED
Active Defense Architecture

Multi-Layer Defense Topology

Observe how tool requests travel through the three defense layers. Select an attack scenario below to see real-time hardware containment in action.

Interactive Threat Ingress & Gating Topology
REQIngress PayloadAgent Tool InvocationLatency: 0.0µsTarget: Host OSL1Kernel SandboxmacOS / Linux bwrapVM Lag: 0msPass-throughL2Policy EngineGoogle CEL HypervisorEval: < 5µsPass-throughL3Context & SecretsDLP & CompactorLatency: < 150µsPass-through
TARGET ENFORCEMENT
Hardware OS Kernel Sandbox (Seatbelt / bwrap)
(deny network-outbound) + (deny file-read-data ~/.ssh/*)
LATENCY BUDGET
0.2µs (Hardware Fast-Path)
Single-digit microsecond overhead
VERDICT STATUS
SYSCALL BLOCKED: EPERM
sys_connect(AF_INET, 185.22.x.x:443) -> -1 EPERM
Layer 1 • macOS / Linux
Kernel Sandbox

OS Hardware Isolation

Agent-based config and guardrails on hyper-fast hardware kernel level. Enforced via macOS Apple Seatbelt and Linux Bubblewrap to physically drop rogue sockets and isolate the filesystem with 0ms VM overhead.

Hardware-level syscall containment
Docs
Layer 2 • AST Hypervisor
Policy Engine

Google CEL Hypervisor

Google Common Expression Language hypervisor evaluating per-agent role attenuation and tool gating in < 5µs. Declaratively ensures read-only subagents cannot execute mutating bash commands.

< 5µs compile-free policy gating
Docs
Layer 3 • DLP & Compactor
Context & Secrets

DLP & Token Compactor

Guards context and tokens against prompt explosion while scrubbing sensitive data, API secrets, and PII before prompts leave your laptop. Eliminates token waste and pricing cliffs.

Zero model secret leakage & 60-90% compaction
Docs
Platform Capabilities

Engineered for Zero Overhead & Total Control

Every capability is delivered as an importable Go package, a CLI command, and a strongly-typed MCP tool.

Zero-CGo Static Go

Compiled strictly with CGO_ENABLED=0. Runs as a single static binary with no external runtime dependencies and sub-millisecond execution.

pkg/sandbox0ms Startup

Google CEL Hypervisor

Google Common Expression Language policy engine evaluates AST facts, caller roles, and session budgets compile-free in under 5µs.

pkg/policy< 5µs Latency

Ed25519 Cryptographic Trust

Every downloaded skill, manifest, and agent envelope is cryptographically signed and verified. Prevents tampered community tooling.

pkg/registry • pkg/a2aZero-Trust

Token Pricing Cliff Defense

Prunes whitespace, compresses repetitive tool outputs, and slices context before reaching the 128k/200k provider pricing cliffs.

pkg/tokens60-90% Savings

Tamper-Evident Audit Ledger

Embedded SQLite audit ledger records every syscall verdict, policy evaluation, and tool trajectory for complete post-incident forensics.

pkg/backlog • local/*.sqliteImmutable

Universal MCP Gateway

Transparent stdio proxy gating all Model Context Protocol requests. Works seamlessly with Antigravity, Cursor, Claude Desktop, and VS Code.

cmd/mcp-server • cmd/ctxUniversal
Interactive Policy Hypervisor

Live Google CEL Policy Engine

Test how declarative Common Expression Language rules intercept dangerous actions in microsecond runtime.

cel.dev/cel-go v0.32.0
Hypervisor VerdictNative Go Evaluator
Click “Evaluate Security Policy” to test the CEL expression.
Google CEL EngineSafe & Compile-Free
Ed25519 Cryptographic Trust

Module Registry & Capabilities

Discover, verify, and install verified security modules with signed provenance and zero-trust envelopes.

@ctxsec/sandbox-kernel1.0.0
Verified: ed25519:6c2a...f901

0ms in-kernel OS containment for macOS (Apple Seatbelt) and Linux (Bubblewrap). Drops sockets without Docker overhead.

sandbox_inspect_profilesandbox_detect_engine
License: Apache-2.0
@ctxsec/context-optimizer1.0.0
Verified: ed25519:7a4f...e89b

Universal token and cost compactor: 128k pricing cliff prevention, whitespace compaction, and multi-tier router.

tokens_compacttokens_route_tasktokens_evaluate_clifftokens_circuit_check
License: Apache-2.0
@ctxsec/guard-pii1.0.0
Verified: ed25519:3b19...fa02

Zero-allocation Shannon entropy secret scanner and Luhn credit card, SSN, and email redaction.

guard_scanguard_redactguard_redact_piiguard_mask_tools
License: Apache-2.0
@ctxsec/a2a-envelopes1.0.0
Verified: ed25519:9f40...11bc

Zero-Trust Ed25519 signed delegation envelopes, 3-step X25519 ECDH mutual handshake, and key rotation.

a2a_signa2a_verifya2a_handshake_inita2a_handshake_respond
License: Apache-2.0
Cross-Tool Protection

Universal MCP Gateway Setup

Transparently intercepts, gates, and isolates tools across any AI developer environment.

1// .agents/hooks.json (Antigravity CLI & IDE PreToolUse Interception)
2{
3  "ctxsec-guard": {
4    "enabled": true,
5    "PreToolUse": [
6      {
7        "matcher": "run_command|write_to_file|replace_file_content",
8        "hooks": [
9          {
10            "type": "command",
11            "command": "ctx hook --format=antigravity",
12            "timeout": 5
13          }
14        ]
15      }
16    ]
17  }
18}
1-Click Protocol Deep Link: Trigger instant IDE install dialog via OS handler
⚡ Open in Antigravity IDE