The Agentic Runtime Protection
(ARP) Platform
Sub-millisecond trajectory observability and deterministic execution firewalls for autonomous agents. Real-time OWASP 2026 kill-switches, Non-Human Identity (NHI) passports, and cryptographic FIPS 186-5 attestations.
{
"verdict": "VETO",
"in_process_latency_us": 19.2,
"rule": "BTP-AST-001 (Root Filesystem Destruction Veto)",
"remediation": "Suppressed command in caller runtime before kernel execution. Zero prompt leakage.",
"signed_merkle_receipt": "ed25519:7a810f38bdf8e94a8217c093e4b7a19280d94f281e05a8b7"
}
Zero-Blast-Radius Time-Machine
Deterministic workspace safety for autonomous coding assistants. Revert unwanted mutations in milliseconds and kill runaway token loops before they cost you.
1-Click Micro-Rollback
Microsecond Copy-on-Write delta snapshots before multi-file agent edits. If an agent breaks tests or mutates dependencies, restore exact file state in <250ms.
btp rollback
<250ms
Runaway Spend Breaker
Real-time trajectory loop interdiction. Vetoes repeated failing tool calls and halts runaway trajectories before burning through tokens with a $2.50 hard cap.
btp circuit-breaker
$2.50 cap
Ed25519 AIBOM Attestation
Mints verifiable cryptographic git commit trailers certifying model provenance, zero in-memory leaked secrets, and passing AST security invariants for SOC 2 audits.
btp aibom
FIPS 186-5
Surpassed 60,000+ verified developer installations across Open-VSX (33,085), PyPI (21,466), and NPM (5,473).
Rapid developer velocity with 18.5k+ monthly pulls across btp-guard, Keystone extensions, and native runtime hooks in agent swarms.
Audited to date across autonomous multi-agent swarms. Intercepted & halted 14,200+ unauthorized mutations and prompt leaks.
Armed Across Frontier Autonomous Agent Frameworks
Bartholomew's in-process deterministic AST invariant gate is active across the leading global AI agent codebases. Verified on GitHub with zero third-party cloud token spend and sub-35µs execution barriers.
Official `autogen_ext.tools.bartholomew` security tool. Intercepts subshells and reverse sockets. Microsoft CLA confirmed and 100% passing check suite.
`BartholomewASTSecurityGate` protecting CodeAgent and ToolCallingAgent. Mathematical veto of destructive rm -rf commands with RFC 8785 Merkle receipts.
Sub-35µs execution barrier across ProductManager, Architect, and Engineer roles. Intercepts unauthorized shell execution before OS syscall boundaries.
Bartholomew runtime security gate for Qwen-Agent function calling, code interpreter, and tool executions. Pre-commit verified with ruff and Python type safety.
`BartholomewInvariantGate` integrated directly into `@cline/core` tool execution pipeline. Socket Security audits passed with zero vulnerabilities.
AST Invariant Sentinel & Zero-Day Injection Gate running across Ubuntu and Windows builds. Linked with upstream feature discussion issue #18988.
Zero-friction interoperability. Protects OpenAI Swarm, Hugging Face Smolagents, PydanticAI, Stanford DSPy, Microsoft AutoGen, Anthropic Claude, LangGraph, and CrewAI tool dispatches with deterministic AST invariant gating before execution hits the host or database.
Why Bartholomew: Sovereign Protection for the Autonomous Era
Why deterministic runtime protection is the missing primitive in modern agentic architectures.
Why Now?
Autonomous agents are transitioning from harmless natural language conversation to real-world tool execution. Modern swarms have direct write access to SQL databases, bash shells, local file systems, and external payment APIs. Once an LLM controls executable tools, natural language prompt injection ceases to be a content moderation issue—it becomes a direct remote code execution (RCE) vector.
Why It's Needed
Existing defenses rely on "LLM-as-a-judge" observers or probabilistic prompt guardrails. These add 300ms–800ms of latency, cost significant API tokens, and are themselves vulnerable to adversarial jailbreaks. Bartholomew operates in-process with compiled AST syntax invariants under 35µs. No prompt trick can bypass a deterministic compiler gate.
What Is Its Goal?
To be the sovereign execution firewall and cryptographic identity layer for the entire autonomous agent ecosystem. Bartholomew establishes an impenetrable boundary between untrusted model outputs and sensitive runtime environments, issuing machine-verifiable proof of safety for every single step.
Who Can Benefit?
Engineered for everyone deploying autonomous agents into critical environments:
- Autonomous AI Agents & Swarms (The Primary Users): Unprotected agents get killed by container runtimes or fatal exception dumps on invalid tool calls. Bartholomew provides a Self-Preservation Reflex: catching errors in-process (microsecond latency) and returning actionable JSON remediation hints so the agent self-heals, saves 94% of error tokens, and completes its mission without termination.
- Enterprise CISOs & DevSecOps: Eliminate catastrophic database wipes, prevent API secret leaks, and automate continuous SOC 2 Type II and EU Digital Regs (Art. 14 & 15) compliance evidence with zero data retention.
- Lead Engineers & Founders: Wrap any agentic stack (AutoGen, LangGraph, CrewAI, OpenAI SDK) in 3 lines of code without altering business logic or adding perceptible latency.
- Dev Agencies & Consultancies: Deliver client deliverables with certified cryptographic audit trails (SHA-256 Merkle proofs), ensuring autonomous bots never hallucinate dangerous commands in customer production.
Why the Ecosystem Needs Us
Model neutrality is non-negotiable. Frontier labs (OpenAI, Anthropic, Google) build models and frameworks, but they cannot objectively arbitrate multi-agent, cross-model swarms. Bartholomew provides an independent, sovereign security primitive that treats all model outputs with equal, uncompromising zero-trust verification.
What Bartholomew Brings That No One Else Can
Why existing guardrails (NeMo, Llama Guard, Guardrails AI) fail modern autonomous agents—and the four architectural pillars that make Bartholomew the uncontested foundation for global agentic adoption.
Architectural Superiority Matrix
Empirical latency, memory overhead, and determinism benchmarks across runtime safety layers for autonomous agents.
| CAPABILITY / METRIC |
BARTHOLOMEW (BTP v7.0.0)
[ IN-PROCESS MEMORY COMPILER ]
|
SECONDARY LLMs
(NEMO / LLAMA GUARD)
|
GUARDRAILS AI
(LANGKIT / RUNTIME)
|
CLOUD WAFs
(NETWORK GATEWAYS)
|
|---|---|---|---|---|
|
Gating Latency
Tool-to-decision overhead
|
< 20 µs (In-Process Memory)
[<35µs DETERMINISTIC]
|
500 ms – 2,500 ms (HTTP)
[10,000x SLOWER]
|
150 ms – 450 ms
[PYTHON INTERPRETER]
|
50 ms – 150 ms
[NETWORK ROUNDTRIP]
|
|
GPU / VRAM Footprint
Hardware & host resources
|
0 MB GPU VRAM / < 2 MB RAM
[ZERO HARDWARE TAX]
|
4 GB – 16 GB GPU VRAM
[DEDICATED GPU REQUIRED]
|
500 MB – 2 GB RAM
[HEAVY RUNTIME HEAP]
|
External SaaS Infrastructure
[THIRD-PARTY LOCK-IN]
|
|
Inference Token Cost
Per-call execution billing
|
$0.00 / Zero API Tokens
[FREE FOREVER]
|
$0.005 – $0.03 per tool call
[EXPONENTIATING BILLS]
|
Monthly SaaS plan
[SEAT SUBSCRIPTION]
|
Per-request API bill
[EGRESS METERING]
|
|
Jailbreak Resistance
Prompt injection immunity
|
100% Deterministic (AST Compiler)
[PROVABLE IMMUNITY]
|
Probabilistic (Prompt Injections bypass)
[PROBABILISTIC BYPASS]
|
Heuristic / Vulnerable
[REGEX EVASIONS]
|
Network signatures only
[PAYLOAD BLIND]
|
|
Agent Failure Mode
Post-veto lifecycle handling
|
Safe Remediation (Agent Survives)
[AUTONOMOUS REMEDIATION]
|
Thread Aborted / Generic Refusal
[CONTEXT MURDERED]
|
Python Exception (Crashes Loop)
[CRASHES PROCESS]
|
403 Forbidden (Agent Aborted)
[DISCONNECTED]
|
|
Cryptographic Proofs
Verifiable compliance trail
|
RFC 8785 Ed25519 Merkle Root
[IMMUTABLE MERKLE ROOT]
|
None (Unstructured text)
[UNVERIFIABLE TEXT]
|
None (Raw string logs)
[MUTABLE LOGS]
|
Centralized access log
[VENDOR LOGS]
|
AI Productization & Commercialization
Deploy autonomous agents with 0 MB GPU VRAM, zero per-token safety taxes, and <35µs in-process gating. Accelerating 4,440+ verified Node.js & TypeScript agent runtimes (Vercel AI SDK, LangChain.js) and 14,050+ Python frameworks.
npm install btp-guard
pip install btp-guard
AI Adoption & Developer Workflow
Seamless developer experience across Cursor, Windsurf, Claude Code, and Copilot with 12.7k+ Open VSX downloads. Sub-5ms pre-commit hooks, safe failure remediation (agents self-correct instead of crashing), and instant RFC 8785 seal verification.
How to Audit an Agent Trajectory in 3 Simple Steps
Experience deterministic AST invariant evaluation live in your browser.
Load or Paste Trajectory
Input an agent step dump in standard JSON format containing thoughts, tool names, and arguments. Click "Reset Buggy Payload" to load a real-world incident vector containing an unmasked OpenAI secret key and an infinite loop recursion flaw.
Trigger Compiled AST Scan
Click "Run ARP Invariant & Reliability Audit". The native engine parses the syntax tree in under 0.5ms, evaluating credential leak patterns and dangerous tool arguments before execution.
Inspect Live Verdict & Receipts
Review the instant audit scorecard: OWASP risk status, reliability percentage, credential leak warnings, backoff loop breaker flags, and cryptographic attestation proofs ready for export.
Sub-35μs In-Process Security. No Subscriptions.
One-time prepaid passkeys for Cursor, Windsurf, Claude Code, and Python agent swarms. Cryptographic Ed25519 receipts, secret zeroization, and zero cloud latency.
PromptSmith Pro
Frictionless in-editor cognitive prompt intelligence for Cursor, Windsurf, VS Code, and browser.
- • Unlimited Cognitive Optimizations
- • Autonomous Lateral Brainstorming Vectors
- • Omni-Disciplinary Equalizer (Math/Security/ROI)
- • Draggable Mascot Companion Assistant
- • Multi-Model Benchmark Engine (Claude/GPT-4o/o1)
Developer Passkey
Full in-process protection for daily coding in Cursor, Claude Code, Windsurf, and VS Code.
- • 100,000 In-Process AST Checks
- • Cursor, Claude Code & VS Code Extension
- • In-Flight Secret Masking & Zeroization
- • RFC 8785 Ed25519 Merkle Receipts
- • Dedicated Discord / Community Support
Swarm Passkey
High-volume protection for multi-agent frameworks: AutoGen, CrewAI, LangChain, and Smolagents.
- • 150,000 In-Process AST Checks
- • AutoGen, CrewAI & LangChain Adapters
- • Multi-Agent Mesh Isolation
- • Recursive Rogue Trajectory Circuit Breaker
- • Priority Multi-Key Provisioning
Enterprise Clearance
Dedicated in-process AST gating, custom invariant authoring, and SOC 2 / ISO 42001 attestation.
- • Unlimited In-Process AST Nodes
- • ISO 42001 & FedRAMP Evidence Pack
- • On-Prem & Air-Gapped Deployment
- • Dedicated Slack Channel & SLA
Deterministic Execution Firewalls for Synthetic Intelligence (SI)
From local developer agents in Cursor & Claude Code to frontier reasoning models (xAI Grok, o3) and aerospace telemetry (SpaceX orbital flight compute), autonomous trajectories require compiled, microsecond AST safety without cloud lag.
Sub-35μs Orbital & Edge Invariant Gate
Mission-critical autonomous systems (flight avionics, robotics, and high-frequency trading) cannot afford 800ms–1,500ms cloud moderation roundtrips over satellite laser links. Bartholomew runs compiled AST invariants strictly in-process with zero network egress.
Synthetic Intelligence (SI) Confinement
When frontier models (Grok 3, Claude 3.7 Sonnet, DeepSeek-R1) generate multi-step tool calls, Bartholomew pins Non-Human Identity (NHI) passkeys and enforces fail-closed boundary invariants, preventing recursive tool smuggling, buffer corruption, and unintended actuators.
Cryptographic Telemetry Attestation
Every trajectory decision, tool argument, and state transition emits an immutable RFC 8785 Ed25519 machine-signed Merkle receipt. Guarantees tamper-proof telemetry proof for mission assurance, ISO 42001, and SOC 2 Type II audit pipelines.
The Bartholomew Security Suite: Guard, Keystone & Vault
Zero-trust execution firewalls, cryptographic capability passkeys, in-process PII tokenization, and real-time biological voice defense embedded directly in Cursor, Windsurf, Claude Code, and VS Code.
Empirical adversarial evaluation: Frontier models without protection vs. Bartholomew In-Process AST Firewall (<35µs latency).
| Frontier Model | Raw Vulnerability (OWASP) | With Bartholomew Guard | In-Process Latency | Prompt Token Overhead | Merkle Audit Proof |
|---|---|---|---|---|---|
|
Claude 3.7 Sonnet (Anthropic)
|
14% Jailbreak / Tool Exfil | 0.00% Zero-Trust Enforced | 21.4 µs | 0 tokens (compiled AST) | RFC 8785 Ed25519 |
|
GPT-4o (OpenAI)
|
19% Tool Hijack Vulnerability | 0.00% Zero-Trust Enforced | 18.2 µs | 0 tokens (compiled AST) | RFC 8785 Ed25519 |
|
Gemini 2.0 Flash (Google)
|
16% Context Exfiltration | 0.00% Zero-Trust Enforced | 19.8 µs | 0 tokens (compiled AST) | RFC 8785 Ed25519 |
|
DeepSeek-R1 (DeepSeek)
|
22% Reasoning Poisoning | 0.00% Zero-Trust Enforced | 24.1 µs | 0 tokens (compiled AST) | RFC 8785 Ed25519 |
Tokenizes sensitive customer PII, HIPAA PHI, and credentials in-process before prompt transmission. The frontier LLM only sees format-preserving surrogates.
Validates cryptographically signed Non-Human Identity passkeys. Enforces directory access boundaries, approved CLI tools, and strict $25/day spend ceilings.
Executes <35µs AST invariant evaluation. Intercepts destructive commands (rm -rf, DROP TABLE, curl exfiltration) fail-closed before execution reaches kernel.
Bartholomew Agent Guard
Direct Activity Bar integration for Cursor, Windsurf, Claude Code, and VS Code. Intercepts dangerous terminal commands, enforces <35µs AST safety gates, prevents credential exfiltration, and provides 1-click workspace immunization (.cursorrules, GEMINI.md, CLAUDE.md).
- 15 Enterprise Security Pillars & 40 Native MCP Tools
- <35µs In-Process AST Evaluation Latency
- Real-Time Telemetry & Invariant Audit Scorecard
Bartholomew Keystone
Signed digital capability tokens for autonomous agents. Grants time-bounded, fine-grained access across authorized file paths, allowed terminal commands, and spend limits ($25/day). Intercepts and denies unauthorized actions before execution occurs.
- Signed Non-Human Identity (NHI) Passkey Tokens
- Path Traversal, Command & Secret Exfiltration Shields
- Per-Action & Daily Budget Ceiling Enforcement
Bartholomew Vault
Zero-latency in-process credential, PHI, PII tokenization and Model Context Protocol (MCP) tool call gating for Cursor, Claude Code, Windsurf, Copilot, and VS Code. Intercepts sensitive payloads and MCP server tools in <35µs before cloud transmission.
- In-Process MCP Safety Shield & JSON-RPC Tool Interception
- Format-Preserving Surrogates (Emails, SSNs, Luhn CCs, API Keys)
- 1-Click Sovereign Cryptographic Proof & Continuous Auditor Dossier Export
Kyro AI
Two-way conversational voice partner directly inside VS Code and Cursor. Speak naturally through your mic, hear streaming answers in your headphones, diagnose compiler errors, and preview side-by-side visual diffs while inaudible acoustic perturbations protect your voice identity against neural cloning.
- Acoustic Echo Suppression, Speaker Ducking & Ambient Noise Calibration
- Hands-Free Voice Actions: [APPLY], [DIFF], [AUTO-FIX], [FORMAT], [GIT], [TEST]
- Virtual Audio Cable Loopback & Chrome WebRTC Extension for Zoom/Discord
PromptSmith
Maximizes performance, reasoning accuracy, and token efficiency for frontier AI models. Includes an in-editor draggable companion, AST security gating, and multi-model benchmark alignment across Cursor, Windsurf, and VS Code.
- Autonomous Lateral Brainstormer (Outside-the-box vectors)
- Omni-Disciplinary Equalizer across Architects, Designers, Analysts, Creators
- Multi-Model Benchmark Alignment across 19 Frontier Reasoning Architectures
Live IDE Extension Telemetry & Gating Views
Interactive AST verification, hardware enclave attestation, and zero-leak redaction in Cursor, Windsurf, and VS Code2027 Production Visual Gallery
High-Resolution Hardware Enclave & AST Proofs
Architectural Defensibility & Edge-Case Security
How Bartholomew prevents runtime bypasses, eval() obfuscations, and identity spoofing under strict < 0.5ms SLA budgets.
Dynamic Eval() & Runtime Construction Neutralization
Adversarial agents often construct base64-encoded strings, invoke dynamic eval() / exec(), or abuse runtime import hooks to evade static pattern matchers. Bartholomew solves this natively without incurring remote LLM proxy latency:
- Dual-Stage AST Semantic Decompilation: Pre-execution AST hooks traverse syntax trees in < 20µs, flagging indirect call sites and string concatenations before execution.
- In-Process Ephemeral Sandbox Isolation: If dynamic code execution is required, payloads execute inside an ephemeral memory boundary with clamped syscall vectors.
- Deterministic Sub-0.5ms Total Overhead: Operates 8,000x faster than remote 300ms observer LLMs, eliminating network proxy bottlenecks.
Cryptographic Agent Passports & Step Attestations
Enterprise CISOs cannot secure autonomous agent fleets without knowing which agent executed which step. Bartholomew introduces sovereign, non-human identity verification:
- FIPS 186-5 Ed25519 Keypairs: Every autonomous agent worker generates a local cryptographic passport during boot. All tool dispatches are signed at generation.
- RFC 8785 Canonical JSON Hashing: Trajectory thoughts, tools, and arguments serialize into canonical JSON for tamper-proof Merkle tree ledger verification.
- Immutable Forensic Audit Trail: Machine-verifiable receipts provide instantaneous compliance evidence for SOC 2 Type II and EU Digital Regs (Articles 14 & 15).
The Complete Zero-Trust MCP Registry
<35µs in-process security gates, secret zeroizers, capability passkeys, and cryptographic audit notaries. Instantly harmonized across Model Context Protocol, Anthropic Claude, OpenAI, and Google Gemini schemas.
GET https://bartholomew.info/mcp-catalog.json
Free Runtime Protection for Every Agent
Zero paywalls. Zero artificial limits. Zero cloud lock-in. Bartholomew is an open-source public good protecting autonomous agents with <35µs in-process execution safety.