Show HN: VajraClaw – Deterministic <1µs execution guardrail for AI agents

wpnews.pro

DROS VajraClaw Hacker Edition is the official standalone, free Docker governance gateway designed for individual developers, AI researchers, and local developer workstations. It physicalizes execution security between autonomous AI Agents (Google Antigravity, Anthropic Claude, OpenAI Codex, Cursor, CrewAI, AutoGen, DeepSeek Harness) and your local operating system.

Probabilistic security relying on Prompt Engineering, Llama-Guard, or LLM-as-a-judge inevitably fails at runtime:

Prompt Injections & Jailbreaks Bypass Text Guards: Attackers easily obfuscate prompts to trick agents into runningrm -rf /

or leaking.env

secrets.Unpredictable Latency & TOCTOU: Calling secondary models adds 1~3s delays and fails to protect OS syscalls.** Lack of Auditability**: You cannot mathematically provewhyan LLM wrapper allowed an action.

DROS is NOT a prompt wrapper; it is a Deterministic Runtime OS: It moves intelligence to compile-time (demo_policy.yaml

/ Vajra.md

) and enforces rules at runtime via constant-time Strict Fail-Closed)!

🛡️ Protect Up to 5 Concurrent Agents: Simultaneously govern multiple active agents across different IDEs on a single host. - 🔑 Native W3C: Cryptographic agent identity binding with Ed25519 signatures.did:key

& RFC-010 Passports - ⚡ Microsecond In-Band Fusing (<1μs): Deterministic$\mathcal{O}(1)$ AST policy lookup that severs unauthorized syscalls before execution. - 📜 SHA-256 Merkle Hash-Linked Audit Chain: Non-repudiable local execution logs with startup recovery to prevent log tampering. - 🌐 Universal Cross-Ecosystem Compatibility: Native REST and MCP endpoints compatible with AGY, Claude, Codex, Cursor, LangChain, CrewAI, and DSH.

Threat Vector / Capability	Traditional LLM Guardrails	📦 DSH Standalone TS Plugin
Runtime Vehicle
Cloud API / External Model	In-Process JS (Zero Deps)	Local Docker Container (`:8080` )
Enterprise Cluster / K8s / C-ABI
Protected Scope
Single Chat Session	DSH Local Process	Full Ecosystem (Claude+Codex+Cursor+DSH+AGY)
Multi-Node Fleet / Private Cloud
Destructive Command Blocking
❌ Vulnerable	🟢 100% Regex Failsafe

🟢 100% Deterministic AST Fusing (<1μs)

🟢 AST Bitmaps + eBPF Kernel Hooks

Credential & Secret Protection
❌ No Physical Guard	🟢 Sensitive Path Block

🟢 Dynamic PII Redaction + Virtual Sandboxing

🟢 Hardware HSM + ZKP-Lite Proofs

Agent Identity Binding
❌ No Identity	🟡 Session-level ID	🟢 Native W3C
`did:key` (Ed25519)
🟢 3-Tier PKI
`DrosIdentityToken (DIT)`
Non-Repudiable Audit Chain
❌ Plain Text Logs	🟢 Local SHA-256 Hash Chain

🟢 Ed25519 Signed Merkle Hash Chain

🟢 EU AI Act Art. 12 Court-Grade Chain

RFC-010 Passports
❌ Unsupported	🟡 Format Parser	🟢 Local Minting & Cross-Agent Verification

🟢 Cross-Organization Roaming Passports

Decision Latency
🔴 1,000 ~ 3,000 ms	🟢 <1 ms (Direct Hook)

🟢 <1 ms (Loopback HTTP / C-ABI)

🟢 <500 ns (Zero-Copy Memory Lookup)

License
Pay-per-Token	100% Free (Apache-2.0)
Free License for Individuals
Startup $2,990 / Enterprise $29,990

docker run -d -p 8080:8080 --name dros-gateway \
  -v $(pwd)/FreeTrial-Sandbox/demo_policy.yaml:/app/demo_policy.yaml \
  dros/hacker-gateway:v1.0.0

curl http://localhost:8080/health
git clone https://github.com/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker.git
cd DROS-VajraClaw-Hacker
docker compose -f docker/docker-compose.yml up -d

See examples/ for working starter templates:

See examples/claude_mcp/: Add to your

claude_desktop_config.json

or mcp_settings.json

:

{
  "mcpServers": {
    "dros-vajraclaw": {
      "url": "http://localhost:8080/mcp",
      "transport": "http"
    }
  }
}

See examples/cursor_rules/: Place

.cursorrules

in your project root to intercept high-risk terminal commands via http://localhost:8080/evaluate

in <1μs before OS execution!See examples/openai_langchain/:

from integrations.vajraclaw.runtime import VajraClaw

vc = VajraClaw("demo_policy.yaml")
decision = vc.evaluate("execute_payment", {"amount": 500})
if not decision:
    raise PermissionError(f"Blocked by DROS: {decision.reason}")

See examples/crewai_autogen/: Assign individual W3C DIDs to different agent roles (Legal, Dev, Auditor) and enforce fine-grained capability bitmaps across agent swarms.

See examples/dsh_plugin/:

dsh plugin --profile web add dsh-plugin-vajraclaw

(Set gatewayUrl to http://localhost:8080 in DSH to activate W3C DID & full Docker gateway governance)

DROS supports two straightforward formats: Intuitive Markdown ( Vajra.md) and

Structured YAML (.

demo_policy.yaml

)Declare allowed capabilities and hard security boundaries in plain Markdown:


## 1. Allowed Capabilities
- Allow reading workspace files (`file_read`)
- Allow standard queries (`search_web`, `query_db`)
- Allow safe terminal commands (`git status`, `npm test`, `cargo check`)

## 2. Strict Fail-Closed Boundaries
- Block all recursive deletion or wiping commands (`rm -rf`, `rmdir /s`, `format`)
- Block access to credential paths (`.env`, `id_rsa`, `secrets.json`, `.aws/credentials`)
- Restrict transaction amounts exceeding $1,000 threshold (`amount <= 1000`)

You don't need to write policies from scratch! Copy the following universal prompt to ChatGPT, Claude, or Cursor:

📋

Copy this Prompt to any LLM / AI Assistant:

You are a DROS deterministic security architecture expert. Based on my Agent requirements, generate a standard DROS "Vajra.md" security policy in Markdown.

Agent Details:
- Agent Role & Scenario: [e.g., Fullstack Developer / Customer Service / Financial Automation]
- Allowed Tools & Operations: [e.g., Read/Write src/, Run tests, Query order database]
- Strict Boundaries & Denials: [e.g., Block deletion of root/workspace, Block .env access, Payment limit $500]

Follow the DROS "Default Fail-Closed" whitelist principle and structure the output into:
1. Role & Capability Scope
2. Allowed Capabilities (Whitelist)
3. Security Boundary Constraints (Thresholds & Pattern Failsafes)

Simply mount your Vajra.md

when launching the Docker gateway. Policy changes take effect in <1 microsecond without container restarts:

docker run -d -p 8080:8080 --name dros-gateway \
  -v $(pwd)/Vajra.md:/app/demo_policy.yaml \
  dros/hacker-gateway:v1.0.0

The deterministic execution governance, microsecond fusing, and cryptographic audit mechanisms in this project are referenced from and build upon the following core technical papers and verification environments:

Core Architecture & Six Trust Boundaries (Core Architecture):** Paper**:DROS-6P: A Unified Deterministic Runtime Governance Architecture Closing the Six Fundamental Trust Boundaries of Enterprise AI AgentsZenodo DOI:|10.5281/zenodo.21833970

Archived Record:zenodo.org/records/21833970

Defense-in-Depth Model (4-Layer Security):** Paper**:DROS 4-Layer Defense-in-Depth Architecture for Autonomous AI WorkloadsZenodo DOI:|10.5281/zenodo.21903475

Archived Record:zenodo.org/records/21903475

Runtime Attribution & C-ABI Module (Attribution Framework):** Paper**:Runtime Attribution Framework: An External C-ABI and PKI-Based Zero-Trust Infrastructure for Non-Repudiable Execution Governance in Multi-Agent SystemsZenodo DOI:|10.5281/zenodo.21903687

Archived Record:zenodo.org/records/21903687

Open Standards & Verification Sandbox:** RFC-010 Specification**: Adheres to open Agent Identity & Attestation standard (W3C DIDdid:key

& Ed25519 signature chain).Verification Sandbox:DROS-VEP Lite (Reproducible Evaluation Sandbox)** Evaluation Metrics**: 24-hour soak benchmark results (160,611 verified requests, 26.1μs decision latency).

Strict Fail-Closed Enforcement:- By default, any capability or syscall not explicitly declared as ALLOW

indemo_policy.yaml

is permanently blocked.

By default, any capability or syscall not explicitly declared as Privilege Separation:- The AI Agent must never possess write permissions to policy files. In production, mount policy files as Read-Only.
The AI Agent must License Key Activation (Optional):- Out-of-the-box, the gateway runs in Community mode (supporting 2 concurrent agents). To unlock 5 concurrent agents, pass -e DROS_LICENSE_KEY="your-key"

or activate via DSH settings.

Out-of-the-box, the gateway runs in Community mode (supporting 2 concurrent agents). To unlock 5 concurrent agents, pass

Personal & Community Use (Free for Individuals):- Granted permanently for individual developers and researchers (Free License for Individuals) on up to 1 host and 5 concurrent agents. Source code and patent claims are proprietary. Unauthorized redistribution or reverse engineering is strictly prohibited.

Enterprise & Commercial Deployment:- Enterprise implementation or use by corporate entities requires commercial licensing (Startup / Enterprise / Sovereign). Contact service@dr-os.ioor visithttps://dr-os.io.

Enterprise implementation or use by corporate entities requires commercial licensing (Startup / Enterprise / Sovereign). Contact Patent Notice:- DROS deterministic runtime governance and in-band interception technology is protected under U.S. Provisional Patent Application ( U.S. PPA No. 64/111,973, Patent Pending). All commercial and enterprise rights are reserved by Top-Celestial Company Ltd.
DROS deterministic runtime governance and in-band interception technology is protected under U.S. Provisional Patent Application (

source & further reading

github.com — original article Catch AI code hallucinations without asking a model Show HN: Sonde, a local code graph for AI agents that refuses to guess Unlimited Codex, Inside ChatGPT

Show HN: VajraClaw – Deterministic <1µs execution guardrail for AI agents

Run your AI side-project on zahid.host