Securekit

Securekit protects what your models execute—across any AI system.

Securekit is a protocol-agnostic security kernel for AI tool execution.
It sits between any LLM or agent system and the tools they use, enforcing zero-trust execution, sandbox isolation, and policy-driven control.

It is designed to be drop-in, modular, and extensible, working across MCP, OpenAI tool calling, and custom agent frameworks.

🧠 Why Securekit exists

Modern AI systems are no longer just generating text—they are executing actions:

• reading and writing files
• calling external APIs
• running code
• triggering workflows
• interacting with systems and networks

This introduces a critical risk:

Every tool call is a potential attack surface.

Securekit introduces a universal execution security layer that enforces control before any action is executed.

🧱 Architecture Overview

LLM / Agent System
        ↓
Protocol Adapter Layer
(MCP / OpenAI / Custom / Future Protocols)
        ↓
Securekit Core
- Policy Engine
- Capability System
- Prompt Firewall
- Risk Scoring Engine
- Intent Classifier
- Data-Flow Firewall
- Audit & Receipts
        ↓
Sandbox Orchestrator
(gVisor / Firecracker / Docker / WASM)
        ↓
Controlled Execution Layer
(Filesystem / Network / System Boundaries)

⚙️ Full Feature List

🔌 Protocol-Agnostic Design

• Works with any AI system or agent framework
• MCP-compatible adapter layer
• OpenAI tool/function calling support
• Custom protocol adapter interface
• Future-proof protocol abstraction layer

🛡️ Zero-Trust Policy Engine

• Every tool call is validated before execution
• Declarative policy rules
• Multi-layer policy inheritance (global, org, project, session)
• Default-deny security model

🧩 Capability System

• Time-bound permissions (TTL-based access)
• Scoped tool capabilities
• Revocable execution rights
• Fine-grained tool access control

🧠 Prompt Injection Firewall

• Detects instruction override attempts
• Neutralizes hidden or malicious commands in tool outputs
• Protects against indirect prompt injection chains
• Sanitizes untrusted model-generated content

🌐 Data-Flow Firewall

• Controls how data moves between tools
• Prevents unsafe chaining of outputs
• Blocks cross-tool exfiltration patterns
• Enforces risk-based data routing rules

🧪 Execution Simulation Engine

• Simulates tool execution before running it
• Predicts policy violations
• Prevents unsafe actions pre-execution
• Dry-run mode for high-risk operations

📊 Trust & Reputation System

• Dynamic trust scoring per tool
• Behavioral analysis over time
• Automatic risk degradation for suspicious tools
• Adaptive trust-based execution constraints

🧯 Kill Switch & Containment Mode

• Instant execution halt on anomaly detection
• Session isolation mode
• Automatic privilege revocation
• Safe-state fallback execution

🧾 Execution Receipts (Audit System)

• Cryptographically traceable execution logs
• Input/output hashing
• Policy decision tracking
• Sandbox execution metadata
• Full forensic traceability

🔐 Sandbox Execution Layer

• gVisor sandbox support (default)
• Firecracker VM isolation (high-security mode)
• Docker container execution (compatibility mode)
• WASM runtime support (lightweight execution)
• Fully isolated filesystem and network environments

🧭 Intent Classification System

• Classifies tool usage intent:
  • data retrieval
  • system modification
  • external communication
  • unknown behavior
• Policy enforcement based on intent type

Intent Classification System Module

Enable intelligent intent-aware security through coordinated multi-agent analysis that evaluates why a tool is being invoked before it is executed. Instead of relying solely on tool names or requested actions, specialized agents collaborate to classify execution intent, assess risk, and enforce security policies based on the intended outcome.

Features

• Multi-agent intent classification
• Data retrieval detection
• System modification detection
• External communication detection
• Unknown or ambiguous behavior detection
• Intent confidence scoring
• Context-aware intent analysis
• Cross-agent consensus validation
• Policy enforcement based on classified intent
• Intent-specific capability verification
• Automatic escalation for uncertain intent
• Intent anomaly detection
• Historical intent comparison
• Intent audit logging
• Configurable intent taxonomies
• Custom intent classification plugins
• Multi-label intent support
• Intent conflict resolution
• Adaptive learning hooks for future classifiers
• Real-time intent monitoring
• Explainable classification decisions
• Integration with policy engine and sandbox controls

Multi-Agent Workflow

1. Request Analysis Agent

   • Parses the incoming tool request.
   • Extracts contextual metadata and execution goals.

2. Intent Classification Agent

   • Determines the most likely execution intent.
   • Assigns confidence scores to one or more intent categories.

3. Context Validation Agent

   • Reviews conversation history, workflow state, and previous actions.
   • Detects inconsistencies or suspicious context.

4. Risk Assessment Agent

   • Evaluates the security implications of the classified intent.
   • Identifies high-risk or unexpected behavior.

5. Policy Enforcement Agent

   • Applies intent-specific security policies.
   • Validates permissions, capabilities, and execution constraints.

6. Consensus Agent

   • Resolves disagreements between classification and validation agents.
   • Produces a final verified intent decision.

7. Audit Agent

   • Records classification results, confidence levels, policy decisions, and execution outcomes for forensic analysis.

Supported Intent Categories

• Data Retrieval
• System Modification
• External Communication
• Unknown Behavior
• Custom administrator-defined intents

Benefits

• Prevents execution based solely on model-generated assumptions
• Detects malicious or unexpected behavioral patterns
• Improves zero-trust decision making
• Reduces prompt injection attack impact
• Enables granular policy enforcement
• Provides explainable security decisions
• Enhances auditability and compliance
• Supports protocol-agnostic AI security across any LLM or agent framework

🌍 Network Security Controls

• Default deny outbound network access
• Domain/IP allowlisting
• Tool-specific network policies
• Optional request-level inspection
• Exfiltration detection heuristics

🔁 Cross-Protocol Translation Layer

• MCP ↔ OpenAI tool interoperability
• Unified execution model across frameworks
• Adapter-based protocol conversion
• Future protocol compatibility built-in

🧩 Plugin Architecture

• Extendable security pipeline
• Custom firewall modules
• Risk scoring plugins
• Compliance and governance modules
• Domain-specific security extensions

🔁 Execution Simulation & Preview Mode

• Pre-execution analysis of all tool calls
• Policy impact preview
• Safe evaluation of high-risk operations

🔐 Cryptographic Policy Signing

• Signed policy enforcement
• Tamper-proof configuration validation
• Secure policy distribution for teams and enterprises

📈 Observability Dashboard (planned)

• Tool execution graphs
• Policy decision tracing
• Sandbox activity monitoring
• Risk heatmaps
• Security event timeline

🧩 Design Philosophy

No AI system should directly execute, access, or communicate without passing through a verifiable security kernel.

Securekit enforces:

• Zero implicit trust
• Controlled execution boundaries
• Full auditability of all tool actions
• Protocol independence (MCP, OpenAI, custom agents, future systems)
• Extensible, plugin-based security architecture

The system is designed as a security substrate for agentic AI, not as an application wrapper.

🚀 Installation (coming soon)

Securekit is currently in early design phase.
Reference implementations will be provided for:

• Python SDK
• Node SDK
• Rust core runtime
• CLI tooling
• Docker deployment
• Kubernetes sidecar mode

🤝 Contributing

Contributions are welcome.

Please ensure all contributions:

• comply with AGPL-3.0+
• maintain Securekit’s zero-trust execution principles
• follow adapter and plugin interface standards
• do not bypass sandbox or policy enforcement layers

Specification Branding License (SBL)

Standard

• Fully AGPL-3.0+ compliant system
• Copyleft enforced for network deployments
• Required attribution:
  • Roxanne Ardary
  • https://www.roxanneardary.com/

Optional

• Specification Branding License (SBL)
  • Attribution-free commercial deployment
  • Pricing based on scale, usage, and deployment scope
  • https://roxanneardary.com/securekit/

📜 License & Notice Requirements

Securekit is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).
By contributing to this project, you agree that your contributions will also be released under this license.

Please note the following:

• All contributions must comply with the AGPL-3.0+ terms.
• Under Section 7 of the license, all redistributions, forks, and derivative works must preserve attribution to:
  Roxanne Ardary and roxanneardary.com.
• Securekit specifications are free to use with attribution. A Specification Branding License can be negotiated upon request.
• The project's notice.md file tracks attribution requirements and contributor acknowledgments.
  Any update that adds new contributors or modifies attribution should also update notice.md.
• When submitting a pull request, ensure that any new files maintain the attribution headers where applicable.
• Network-deployed versions of this software must also remain fully AGPL-3.0+ compliant, including exposure of source code modifications when applicable under the license.

For full legal details, please refer to the AGPL-3.0+ license and the project's notice.md file.

🛡️ Summary

Securekit is a protocol-agnostic security kernel for AI tool execution that provides:

• Zero-trust enforcement
• Sandboxed execution environments
• AI-aware threat detection
• Cross-protocol compatibility
• Full execution auditability

It functions as a universal security layer for agentic AI systems, ensuring that no model can execute tools without passing through a verifiable control plane.

Open Arsenal Hub
https://gitlab.com/Roxanne_Ardary/open-arsenal-specs