Skip to content

Agent Security Guardian: In-Kernel Sandbox & Policy Hypervisor

Welcome to ctxsec (github.com/gosecio/ctxsec), the open-source Declarative Context Security Plane & In-Kernel Hypervisor for Autonomous AI Agents.

graph LR
    subgraph AgentHost["AI Host Environment (Antigravity / Cursor / Claude)"]
        A["Agent Invocation"]
    end

    subgraph Plane1["Plane 1: Context & Cost"]
        DLP["DLP Token Compactor<br/>(Shannon Entropy + PII Scrub)"]
    end

    subgraph Plane2["Plane 2: Google CEL Hypervisor"]
        CEL["CEL Policy Engine<br/>(&lt; 5µs Compile-Free)"]
    end

    subgraph Plane3["Plane 3: Hardware OS Kernel"]
        SB["Apple Seatbelt / Linux bwrap<br/>(0ms Native Sandbox)"]
    end

    A --> DLP
    DLP --> CEL
    CEL --> SB
    SB --> OS["Safe OS Execution"]
Hold "Alt" / "Option" to enable pan & zoom

The Core Problem

Modern AI agent environments (such as Google Antigravity, Cursor IDE, Claude Code, and VS Code) give developers incredible velocity. However, their security architectures share a fatal flaw:

  1. Permissions are Project-Wide: When you approve shell or filesystem access, the grant applies across the entire project. An untrusted researcher subagent inherits the exact same destructive terminal capabilities as your primary coder agent.
  2. Soft Instructions Fail: Advisory system prompts ("please do not access .env or run curl") collapse immediately under indirect prompt injections from untrusted documentation or web searches.
  3. VM/Docker Lag Breaks Flow: Wrapping local developer commands in heavy Docker containers or VMs introduces seconds of startup latency, breaking Go and Node feedback loops.

3 Uncompromising Planes of Real Defense

ctxsec introduces a layered, compile-free defense plane executing in pure static Go with zero CGo:

Defense Plane Execution Layer Latency Budget Mechanism
Plane 1: Context DLP Pre-Prompt Hook / Proxy < 150µs Shannon entropy secret detection, AWS/SSH key scrubbing, and 128k pricing cliff prevention.
Plane 2: CEL Hypervisor PreToolUse Lifecycle < 5µs Google Common Expression Language (cel-go) attenuating subagent capabilities by role.
Plane 3: Kernel Sandbox OS Hardware Syscalls 0ms (Native) Apple Seatbelt (sandbox-exec) on macOS and Bubblewrap (bwrap) on Linux physically dropping network sockets.

Zero-Trust Cryptographic Registry

Every tool manifest, policy file, and agent-to-agent delegation envelope in ctxsec is cryptographically signed using Ed25519 and verified before execution:

# Verify and install a verified community skill
ctx registry install ctxsec/sandbox-kernel

Quick Navigation