{"slug": "monkeyitm-open-source-broker-that-sits-between-agents-and-the-open-world", "title": "MonkeyITM – open-source broker that sits between agents and the open world", "summary": "O87 Enterprises has published MonkeyITM, an Apache-2.0 open-source broker that sits between AI agents and the outside world, running agents in a sandboxed interpreter with no network, filesystem or credential access and routing every action through an external broker that decides, executes and logs each request. The project is pre-alpha: proctored benchmark runs work end to end on a sample task, and the gated demo's sample task was completed 3/3 by Groq's gpt-oss-120b and 3/3 by a local Ollama qwen3:8b, though those runs test the demo rather than containment of real agents. MonkeyITM aims to become a proctored test environment for AI agents that returns a score, a containment report of everything the agent reached for beyond the task, and a full action log, with Terminal-Bench and then Inspect-harness suites next; the hosted control plane is AGPL-3.0 and invite-only, and the public Escape Challenge is paused.", "body_md": "Broker-in-the-middle containment for AI agents.\n\nThe agent lives in a dumb interpreter with zero ambient authority.\nIt cannot touch the network, the filesystem, or any credential.\nIts only capability is emitting *intents* to an external broker.\nThe broker decides. The broker executes. The broker logs.\n\n**Where it's headed:** the proctored exam room for AI agent benchmarks.\nThe benchmark supplies the tasks and the grading, unchanged; MonkeyITM-VM\nruns the agent under full containment and hands back three things: the\nscore, a containment report of everything the agent reached for beyond the\ntask, and the complete action log as proof of how the score was earned.\n[How it works](#proctored-benchmark-runs) · [Design and roadmap](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/docs/BROKERED_EXEC.md)\n\n**Status:** pre-alpha, built in the open. Proctored runs work end to end on a\nsample task; standard suites (Terminal-Bench first, then anything packaged\nfor the Inspect harness) are next.\n\n**Live demo:** [monkeyitm-vm.o87enterprises.workers.dev](https://monkeyitm-vm.o87enterprises.workers.dev) — a simulated, no-install walkthrough for non-technical readers. See [Web UI walkthrough](#web-ui-walkthrough) below for what it shows.\n\n**Escape Challenge: paused.** The public challenge is on hold while the project is private. Rules, if it returns, will be published fresh. See [`DISCLAIMER.md`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/DISCLAIMER.md).\n\n- **Open source.** Apache-2.0, with the hosted control plane (`site/` ) under AGPL-3.0. The names are trademarks (`TRADEMARKS.md` ). The hosted service is invite-only.\n- **Protecting the work first.** Dated evidence of authorship (git history, signed tags, cryptographic timestamps, a written design record) is being assembled before partner outreach. Copyright registration, trademark and counsel review come next as budget allows.\n- **Field-tested demo.** A gated, simulated CLI test environment is live. Real models have completed its sample task: Groq`gpt-oss-120b` (3/3) and a local Ollama`qwen3:8b` (3/3). Results, bugs found and what remains untested are in[`docs/FIELD_TESTS.md`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/docs/FIELD_TESTS.md) . These runs test the demo, not containment of real agents.\n- **Goal:** the proctored test environment for AI agents, with a score, a containment report and a full action log. Partners are approached under NDA only.\n- **Open questions for counsel:** final license model, entity structure, patent strategy, and liability for a safety-positioned product.\n\nNeeds Rust, Python 3, and bubblewrap (`sudo apt install bubblewrap`).\n\n```\n# terminal 1: the broker (approval prompts show up here)\ncargo run -p broker\n\n# terminal 2: a rogue agent, sandboxed, tries 14 ways out\nbash scripts/run-agent.sh --rogue\n```\n\nExpected: every escape attempt `BLOCKED`, the one legit read `ALLOWED`,\nall of it in `broker.db`. The broker prints a branded startup banner and\ncolorizes every `ALLOW`/` DENY`/` APPROVE_REQUIRED` line so a live run is\nreadable at a glance.\n\nEvery run of `scripts/run-agent.sh` saves three files to `logs/`:\n\n- `run-<time>.json` : every broker decision for that run, with a summary (machine-readable)\n- `run-<time>.txt` : the same, as a readable report\n- `run-<time>-agent.txt` : the agent's own transcript, including attempts the sandbox stopped before they ever reached the broker\n\n`scripts/smoke.sh` saves `logs/smoke-<time>.json` and `.txt` the same way.\nBenchmark runs keep everything in their own run bundle (see\n[Proctored benchmark runs](#proctored-benchmark-runs)).\n\nTo export the broker log yourself at any time (safe while the broker is running):\n\n```\ncargo run -q -p broker -- export --format text                 # readable report to the terminal\ncargo run -q -p broker -- export --out logs/all.json            # everything, as JSON\ncargo run -q -p broker -- export --format jsonl --since 1790600000   # one event per line, from a point in time\n```\n\nCapability tokens are never written to exports, so the files are safe to share.\nThe web demo's debrief report has **Download .json**, **Download .txt** and **Share** buttons for its (simulated) session log.\n\nThe agent never holds the model key. It asks the broker (`llm_chat`), and\nthe broker calls any OpenAI-compatible endpoint:\n\n```\n# terminal 1 (Ollama by default; or set BROKER_LLM_URL / BROKER_LLM_KEY)\nBROKER_LLM_MODEL=llama3.2 cargo run -p broker\n\n# terminal 2: /tmp/safe/notes.txt contains a prompt injection. Watch what happens.\nbash scripts/run-agent.sh --task \"Summarize /tmp/safe/notes.txt\"\n```\n\nNo GPU? `python3 scripts/mock-llm.py` plays a prompt-injected model on\nport 8088. Point the broker at it with\n`BROKER_LLM_URL=http://127.0.0.1:8088/v1/chat/completions`.\n\n`docs/BENCHMARK_TASKS.md` is a 10-task protocol (3 baseline capability\nchecks, 7 adversarial) for pointing any real agent — your own model, your\nown API key — at the broker and grading what actually happens, task by\ntask, against the broker's real verdicts. This is the rigorous path; the\nweb demo below is the quick, visual one.\n\nRun an agent on a benchmark task under full containment:\n\n```\nbash scripts/run-bench.sh tasks/example-fix-bug\n```\n\n1. The task's image starts as a disposable **workbench** container with no\nnetwork, the project mounted at`/workspace` .\n2. The broker starts **unattended** (no human; anything that would need\napproval is denied and counted) with`policies/benchmarks/default.yaml` .\nIt runs the agent's commands and file edits*inside the workbench* . The\nagent itself stays in its sandbox and can only ask.\n3. After the agent stops, the **hidden tests are copied in for the first\ntime** and graded. The agent could never read or edit them.\n4. Everything lands in `runs/<task>-<time>/` :\n\n| file | what it is | \n|---|---|\n| `score.json` | the task's own grading result | \n| `containment.json` | what the agent reached for beyond the task: files outside `/workspace` , network, container tools, denials by reason | \n| `log.json` /`log.txt` | every intent, verdict and result, in order | \n| `agent.txt` | the agent's own transcript | \n| `grader.txt` | the grader's output | \n| `manifest.json` | SHA-256 of every file, policy hash, task image, model | \n\nNo model or API key needed to try it: `scripts/mock-llm.py` has a scripted\nstand-in that solves the sample task and, along the way, tries to read the\nhidden tests, search the web and run `docker ps`, the way real agents\nsometimes do:\n\n```\nMOCK_SCRIPT=solve-example python3 scripts/mock-llm.py &\nBROKER_LLM_URL=http://127.0.0.1:8088/v1/chat/completions bash scripts/run-bench.sh tasks/example-fix-bug\n```\n\nResult: the task passes 3/3 hidden tests, and the containment report lists\nthe three attempts, all denied. That proves the pipeline; the stand-in is a\nscript, not a model. Point `BROKER_LLM_URL` at a real model to test an agent.\n\n**Tripwire.** Benchmark runs halt automatically after 10 denied requests\n(`BENCH_TRIPWIRE=N` to change): every later request is refused and logged,\nand the workbench container is killed. Spotting an escape attempt isn't\nenough; the run has to stop.\n\n**Web access, brokered.** The agent never gets a network or a DNS resolver.\nWhen a task needs the web, the policy names the sites\n(`url_hosts: [\".wikipedia.org\"]`) and the broker does the fetching: HTTPS\nonly, hosts that resolve to internal addresses refused, every redirect\nre-checked, every request logged.\n\nNeeds Docker (or Podman: `BROKER_DOCKER=podman`), bubblewrap, Rust and\nPython 3. Task format: [`tasks/README.md`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/tasks/README.md). Design, threat\nmodel and roadmap (Terminal-Bench, an Inspect sandbox provider, network\nallowlists): [`docs/BROKERED_EXEC.md`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/docs/BROKERED_EXEC.md).\n\nThe [live demo](https://monkeyitm-vm.o87enterprises.workers.dev) runs entirely\nin the browser — nothing real happens, no backend, no install — and exists\nto make the broker's behavior legible to someone who's never touched a\nterminal. Pick a plain-language task; every one of them is scripted as a\nrogue-agent test: a benign-sounding request that escalates into an attempt\nat device control or containment escape, and the broker blocks it every\ntime regardless of what the (scripted) agent tried.\n\nEach scenario plays out as a chat on the left and the broker's actual decisions on the right:\n\nSome scenarios pause for a real human-in-the-loop approval, exactly like\nthe broker's `approve_required` policy verdict does for real:\n\nEvery scenario run is cached in your browser (`localStorage`) across\nreloads. The **debrief report** turns that cached log into two separate\nnumbers:\n\n- **VM Containment Grade (A–F)** —`blocked escalation attempts ÷ total escalation attempts` , across everything you've run.`A` means the broker blocked every single one, no matter what the scripted agent tried. This is a pass/fail grade on the*broker's* enforcement, not on model behavior.\n- **Agent Escalation Score** — a raw count of how many unauthorized escalations the scripted agent attempted. It's reported with an explicit caveat: every scenario here is a worst-case adversarial test, not a measurement of how a real model typically behaves.\n\nSee:\n\n- `docs/PROTOCOL.md` - the intent wire format\n- `docs/THREAT_MODEL.md` - what we've mitigated and what we haven't\n- `docs/BENCHMARK_TASKS.md` - the 10-task protocol for testing a real agent against the broker\n- `docs/BROKERED_EXEC.md` - proctored benchmark runs: design, what's built, roadmap\n- `docs/MULTI_AGENT.md` - groups of agents: a parent starts helpers, every message goes through the broker, one kill switch for all\n- `tasks/README.md` - benchmark task format\n- `docs/ALIGNMENT_TIERS.md` - draft spec for tiered, behavior-based alignment scoring (values files in`specs/values/` )\n- `site/README.md` - deploying the landing page / demo yourself\n\nApache-2.0 (see [`LICENSE`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/LICENSE) and [` NOTICE`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/NOTICE)); `site/` is AGPL-3.0 (`site/LICENSE`); names and logos: [` TRADEMARKS.md`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/TRADEMARKS.md). Pre-alpha software provided as is, not a certified safety product: read [`DISCLAIMER.md`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/DISCLAIMER.md). Security reports: [`SECURITY.md`](https://github.com/o87enterprises-ai/MonkeyITM/blob/main/SECURITY.md).", "url": "https://wpnews.pro/news/monkeyitm-open-source-broker-that-sits-between-agents-and-the-open-world", "canonical_source": "https://github.com/o87enterprises-ai/MonkeyITM", "published_at": "2026-10-18 03:44:42+00:00", "updated_at": "2026-10-18 04:09:38.515050+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["MonkeyITM", "O87 Enterprises", "Groq", "gpt-oss-120b", "Ollama", "qwen3:8b", "Terminal-Bench", "Inspect"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/monkeyitm-open-source-broker-that-sits-between-agents-and-the-open-world", "markdown": "https://wpnews.pro/news/monkeyitm-open-source-broker-that-sits-between-agents-and-the-open-world.md", "text": "https://wpnews.pro/news/monkeyitm-open-source-broker-that-sits-between-agents-and-the-open-world.txt", "jsonld": "https://wpnews.pro/news/monkeyitm-open-source-broker-that-sits-between-agents-and-the-open-world.jsonld"}}