Show HN: VajraClaw – Deterministic <1µs execution guardrail for AI agents

DROS VajraClaw Hacker Edition, a free Docker governance gateway from Top-Celestial-Company Ltd, enforces deterministic sub-microsecond execution guardrails for AI agents, blocking unauthorized syscalls via constant-time AST policy lookup and providing Ed25519-signed Merkle audit chains. The tool supports up to five concurrent agents across ecosystems like Claude, Codex, and Cursor, with a free license for individuals.

English /Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/README.md | 繁體中文說明 /Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/README zh.md | 🌐 Official Website https://dr-os.io DROS VajraClaw Hacker Edition is the official standalone, free Docker governance gateway designed for individual developers, AI researchers, and local developer workstations. It physicalizes execution security between autonomous AI Agents Google Antigravity, Anthropic Claude, OpenAI Codex, Cursor, CrewAI, AutoGen, DeepSeek Harness and your local operating system. Probabilistic security relying on Prompt Engineering, Llama-Guard, or LLM-as-a-judge inevitably fails at runtime: Prompt Injections & Jailbreaks Bypass Text Guards : Attackers easily obfuscate prompts to trick agents into running rm -rf / or leaking .env secrets. Unpredictable Latency & TOCTOU : Calling secondary models adds 1~3s delays and fails to protect OS syscalls. Lack of Auditability : You cannot mathematically prove why an LLM wrapper allowed an action. DROS is NOT a prompt wrapper; it is a Deterministic Runtime OS : It moves intelligence to compile-time demo policy.yaml / Vajra.md and enforces rules at runtime via constant-time Strict Fail-Closed - 🛡️ Protect Up to 5 Concurrent Agents : Simultaneously govern multiple active agents across different IDEs on a single host. - 🔑 Native W3C : Cryptographic agent identity binding with Ed25519 signatures. did:key & RFC-010 Passports - ⚡ Microsecond In-Band Fusing <1μs : Deterministic$\mathcal{O} 1 $ AST policy lookup that severs unauthorized syscalls before execution. - 📜 SHA-256 Merkle Hash-Linked Audit Chain : Non-repudiable local execution logs with startup recovery to prevent log tampering. - 🌐 Universal Cross-Ecosystem Compatibility : Native REST and MCP endpoints compatible with AGY, Claude, Codex, Cursor, LangChain, CrewAI, and DSH. | Threat Vector / Capability | Traditional LLM Guardrails | 📦 DSH Standalone TS Plugin | ⚡ DROS Hacker Docker Gateway This Repo | 🏢 Enterprise / Mesh Tier | |---|---|---|---|---| Runtime Vehicle | Cloud API / External Model | In-Process JS Zero Deps | Local Docker Container :8080 | Enterprise Cluster / K8s / C-ABI | Protected Scope | Single Chat Session | DSH Local Process | Full Ecosystem Claude+Codex+Cursor+DSH+AGY | Multi-Node Fleet / Private Cloud | Destructive Command Blocking | ❌ Vulnerable | 🟢 100% Regex Failsafe | 🟢 100% Deterministic AST Fusing <1μs | 🟢 AST Bitmaps + eBPF Kernel Hooks | Credential & Secret Protection | ❌ No Physical Guard | 🟢 Sensitive Path Block | 🟢 Dynamic PII Redaction + Virtual Sandboxing | 🟢 Hardware HSM + ZKP-Lite Proofs | Agent Identity Binding | ❌ No Identity | 🟡 Session-level ID | 🟢 Native W3C did:key Ed25519 | 🟢 3-Tier PKI DrosIdentityToken DIT | Non-Repudiable Audit Chain | ❌ Plain Text Logs | 🟢 Local SHA-256 Hash Chain | 🟢 Ed25519 Signed Merkle Hash Chain | 🟢 EU AI Act Art. 12 Court-Grade Chain | RFC-010 Passports | ❌ Unsupported | 🟡 Format Parser | 🟢 Local Minting & Cross-Agent Verification | 🟢 Cross-Organization Roaming Passports | Decision Latency | 🔴 1,000 ~ 3,000 ms | 🟢 <1 ms Direct Hook | 🟢 <1 ms Loopback HTTP / C-ABI | 🟢 <500 ns Zero-Copy Memory Lookup | License | Pay-per-Token | 100% Free Apache-2.0 | Free License for Individuals | Startup $2,990 / Enterprise $29,990 | 1. Start DROS Hacker Gateway No license key required out-of-the-box docker run -d -p 8080:8080 --name dros-gateway \ -v $ pwd /FreeTrial-Sandbox/demo policy.yaml:/app/demo policy.yaml \ dros/hacker-gateway:v1.0.0 2. Verify health status curl http://localhost:8080/health git clone https://github.com/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker.git cd DROS-VajraClaw-Hacker docker compose -f docker/docker-compose.yml up -d See examples/ /Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples for working starter templates: See examples/claude mcp/ /Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/claude mcp : Add to your claude desktop config.json or mcp settings.json : { "mcpServers": { "dros-vajraclaw": { "url": "http://localhost:8080/mcp", "transport": "http" } } } See examples/cursor rules/ /Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/cursor rules : Place .cursorrules in your project root to intercept high-risk terminal commands via http://localhost:8080/evaluate in <1μs before OS execution See examples/openai langchain/ /Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/openai langchain : python from integrations.vajraclaw.runtime import VajraClaw vc = VajraClaw "demo policy.yaml" decision = vc.evaluate "execute payment", {"amount": 500} if not decision: raise PermissionError f"Blocked by DROS: {decision.reason}" See examples/crewai autogen/ /Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/crewai autogen : Assign individual W3C DIDs to different agent roles Legal, Dev, Auditor and enforce fine-grained capability bitmaps across agent swarms. See examples/dsh plugin/ /Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/dsh plugin : dsh plugin --profile web add dsh-plugin-vajraclaw Set gatewayUrl to http://localhost:8080 in DSH to activate W3C DID & full Docker gateway governance DROS supports two straightforward formats: Intuitive Markdown Vajra.md and Structured YAML . demo policy.yaml Declare allowed capabilities and hard security boundaries in plain Markdown: 🛡️ DROS Agent Security Policy Vajra.md 1. Allowed Capabilities - Allow reading workspace files file read - Allow standard queries search web , query db - Allow safe terminal commands git status , npm test , cargo check 2. Strict Fail-Closed Boundaries - Block all recursive deletion or wiping commands rm -rf , rmdir /s , format - Block access to credential paths .env , id rsa , secrets.json , .aws/credentials - Restrict transaction amounts exceeding $1,000 threshold amount <= 1000 You don't need to write policies from scratch Copy the following universal prompt to ChatGPT, Claude, or Cursor: 📋 Copy this Prompt to any LLM / AI Assistant: You are a DROS deterministic security architecture expert. Based on my Agent requirements, generate a standard DROS "Vajra.md" security policy in Markdown. Agent Details: - Agent Role & Scenario: e.g., Fullstack Developer / Customer Service / Financial Automation - Allowed Tools & Operations: e.g., Read/Write src/, Run tests, Query order database - Strict Boundaries & Denials: e.g., Block deletion of root/workspace, Block .env access, Payment limit $500 Follow the DROS "Default Fail-Closed" whitelist principle and structure the output into: 1. Role & Capability Scope 2. Allowed Capabilities Whitelist 3. Security Boundary Constraints Thresholds & Pattern Failsafes Simply mount your Vajra.md when launching the Docker gateway. Policy changes take effect in <1 microsecond without container restarts : docker run -d -p 8080:8080 --name dros-gateway \ -v $ pwd /Vajra.md:/app/demo policy.yaml \ dros/hacker-gateway:v1.0.0 The deterministic execution governance, microsecond fusing, and cryptographic audit mechanisms in this project are referenced from and build upon the following core technical papers and verification environments: - Core Architecture & Six Trust Boundaries Core Architecture : Paper : DROS-6P: A Unified Deterministic Runtime Governance Architecture Closing the Six Fundamental Trust Boundaries of Enterprise AI Agents Zenodo DOI :| 10.5281/zenodo.21833970 Archived Record : zenodo.org/records/21833970 https://zenodo.org/records/21833970 - Defense-in-Depth Model 4-Layer Security : Paper : DROS 4-Layer Defense-in-Depth Architecture for Autonomous AI Workloads Zenodo DOI :| 10.5281/zenodo.21903475 Archived Record : zenodo.org/records/21903475 https://zenodo.org/records/21903475 - Runtime Attribution & C-ABI Module Attribution Framework : Paper : Runtime Attribution Framework: An External C-ABI and PKI-Based Zero-Trust Infrastructure for Non-Repudiable Execution Governance in Multi-Agent Systems Zenodo DOI :| 10.5281/zenodo.21903687 Archived Record : zenodo.org/records/21903687 https://zenodo.org/records/21903687 - Open Standards & Verification Sandbox : RFC-010 Specification : Adheres to open Agent Identity & Attestation standard W3C DID did:key & Ed25519 signature chain . Verification Sandbox : DROS-VEP Lite Reproducible Evaluation Sandbox https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite Evaluation Metrics : 24-hour soak benchmark results 160,611 verified requests, 26.1μs decision latency . Strict Fail-Closed Enforcement :- By default, any capability or syscall not explicitly declared as ALLOW in demo policy.yaml is permanently blocked. - By default, any capability or syscall not explicitly declared as Privilege Separation :- The AI Agent must never possess write permissions to policy files. In production, mount policy files as Read-Only. - The AI Agent must License Key Activation Optional :- Out-of-the-box, the gateway runs in Community mode supporting 2 concurrent agents . To unlock 5 concurrent agents, pass -e DROS LICENSE KEY="your-key" or activate via DSH settings. - Out-of-the-box, the gateway runs in Community mode supporting 2 concurrent agents . To unlock 5 concurrent agents, pass Personal & Community Use Free for Individuals :- Granted permanently for individual developers and researchers Free License for Individuals on up to 1 host and 5 concurrent agents. Source code and patent claims are proprietary. Unauthorized redistribution or reverse engineering is strictly prohibited. Enterprise & Commercial Deployment :- Enterprise implementation or use by corporate entities requires commercial licensing Startup / Enterprise / Sovereign . Contact service@dr-os.io mailto:service@dr-os.io or visit https://dr-os.io https://dr-os.io . - Enterprise implementation or use by corporate entities requires commercial licensing Startup / Enterprise / Sovereign . Contact Patent Notice :- DROS deterministic runtime governance and in-band interception technology is protected under U.S. Provisional Patent Application U.S. PPA No. 64/111,973, Patent Pending . All commercial and enterprise rights are reserved by Top-Celestial Company Ltd. - DROS deterministic runtime governance and in-band interception technology is protected under U.S. Provisional Patent Application