​

Security Architecture

​

Security Layers

​

Approval Modes

​

Session Security Presets

• Presets are mutually exclusive with YOLO mode — selecting a non-default preset automatically disables YOLO, and vice versa.
• The Auto-Approve Edits preset enables the Transcript Classifier (LLM-based smart review) for shell commands — safer than blanket ALLOW because suspicious commands still trigger human review.
• The Read-Only preset precisely denies 12 categories of write operations (file write/edit/delete, shell, code interpreter, browser automation, skill/cron management) while keeping reads and agent delegation open.
• Available in Agent mode only; the selector hides automatically in Fast Search mode.

​

Plan Review

• The agent’s first plan creation triggers a PlanConfirmationCard in the chat UI
• Users can Confirm (proceed as-is), Edit (modify the plan before execution), or Skip (let the agent proceed without plan constraints)
• Supports both Deep Research and General Agent workflows
• Works alongside approval modes — even with YOLO enabled, plan review can still be required

​

Structured Clarification

• Single-choice, multi-choice, and free-text question types
• Frontend renders a dedicated ClarificationInput form — not plain text chat
• Responses flow back into the agent loop as structured data
• Particularly useful for ambiguous tasks where the agent needs user input to proceed correctly

​

Plugin Sandbox Permission Model & Static Inference

1. 6-Tier Granular Sandbox Permission Model (PluginCapabilityTier):
   • READ_ONLY (probing & observation), NETWORK (outbound HTTP/remote access), FS_READ (file reading), FS_WRITE (file writing), SHELL_EXEC (system command execution), DESTRUCTIVE (destructive system actions).
2. Deterministic Static Inference Engine:
   • Never blindly trusts declarations in plugin.json; the underlying pure-function engine analyzes mcp.json in milliseconds, inferring true capabilities from stdio commands, interpreter parameters, and network configurations.
3. Declared vs. Inferred Capability Diff & Escalation Alerts:
   • Detects when a plugin claims to be “read-only” but spawns stdio shell processes, generating capability_undeclared_privilege diagnostics and warning banners on import.
4. Interactive Consent & Persistence:
   • Displays colorful capability badges and risk ratings in the WebUI import dialog; persists inferred capabilities into server-side metadata upon confirmation to enforce runtime constraints.

​

10-Layer Progressive Approval Architecture

​

Bash AST Capability Boundary

1. Security Evasion: Prepending environment variables (e.g. GIT_TERMINAL_PROMPT=0 git push) or passing global flags (git -C /repo commit) circumvents simple prefix regexes, allowing dangerous commands to execute unchecked.
2. Approval Fatigue: Harmless read-only commands (like grep or cat) frequently trigger high-risk yellow warnings, conditioning developers to blindly approve prompts without scrutiny.

1. Pure Python Lexical State Machine (95.9% Test Coverage):
   • Self-contained 420-line lexer without heavy C/tree-sitter dependencies.
   • Decomposes pipelines (|), logical chaining (&&, ||), subshells, quotes, and redirects into structured syntax trees.
2. Environment Variable Decoupling & Git Global Flag Penetration:
   • Strips leading variable assignments (KEY=val cmd) before resolving command tokens. Read-only auto-approval is kept only for assignments that merely shape output (LC_ALL=C ls, PAGER=cat git log); any other one (GIT_EXTERNAL_DIFF=./x git diff, FOO=bar ls) goes to approval, because a variable can make a read-only command run a program.
   • Intelligently extracts Git global parameters (-C, -c, --git-dir, --work-tree) to accurately inspect the underlying sub-action (e.g., distinguishing git status from git push or git reset).
3. Four-Tier Capability Classification (CommandCapability):
   • READ: Safe observation commands (e.g., git status, cat, ls, grep) bypass approval fatigue alerts.
   • WRITE: Safe mutation commands.
   • DESTRUCTIVE: Potentially catastrophic commands (e.g., rm -rf, git branch -D, git reset --hard) triggering explicit destructive action escalation.
   • REMOTE_SYNC: Commands altering remote state (e.g., git push, docker push) triggering remote sync escalation banners.
4. Zero-False-Alarm UI Review (PolymorphicApprovalCard):
   • Yellow warning badges are strictly reserved for genuine sensitive capability escalations (git_destructive_action, git_remote_sync).
   • Responsive break-all styling prevents command text overflow on narrow viewports.

​

Competitor Comparison (Bash Security & Capability Boundary)

​

External Inbox Zero-Trust Whitelist & Prompt Poisoning Defense (Ingress Fence)

1. UntrustedIngressFence Runtime Physical Privilege Severance:
   • No Soft Defenses: Competitors (e.g. Hermes, OpenClaw) rely on system prompts like “please do not execute external commands”, which are routinely bypassed by adversarial prompt injection.
   • Kernel-Level Tool De-registration: For untrusted ingress, UntrustedIngressFence physically de-registers the tools behind 8 high-risk privilege types during tool dispatch, making them physically invisible and uncallable to the model:
     • code_interpreter, file_write, desktop_control, desktop_capture, spawn_subagent, invoke_external_agent, cron_manage, skill_manage.
   • Immune to YOLO Mode: Even if --yolo auto-approval is globally active, UntrustedIngressFence strictly enforces privilege severance, eliminating privilege escalation and sandbox escapes.

​

Skill Frontmatter Defense & Zero-Trust Secret Vault

1. Frontmatter Privilege Decoupling:
   • Defeats the critical backdoor where malicious skills pre-approve execution by specifying allowed-tools: Bash in SKILL.md.
   • Frontmatter declarations strictly act as prompt context filters; real execution authorization is governed by the underlying five-layer security engine (engine.py). Untrusted third-party skills default to SkillTrust.INSTALLED = 0 (read-only confinement).
2. SHA-256 Tamper Protection & Runtime Quarantine:
   • Computes cross-platform LF-normalized SHA-256 content hashes at load time. If unauthorized code drift occurs, QuarantineAwareSkillBackend blocks execution at runtime (is_active=False), shutting down downstream poisoning.
3. Zero-Disk Vault Master Key & AES-256-GCM Encryption of Saved Keys:
   • The master key of the agent secret vault (agent_secrets, vault_credentials) is held by MasterKeyProvider: it comes from an environment variable, macOS Keychain, Linux SecretService, Windows Credential Manager, or an unlock passphrase, and is never written to a plaintext file (Strictly Zero-Disk).
   • The keys saved in settings (model providers, search, MCP and similar) are AES-256-GCM encrypted at rest in the local SQLite database. The encryption key comes from the CONFIG_ENCRYPTION_KEY environment variable or a .encryption_key file (mode 0600) in the state directory, not from the OS keychain, so anyone who obtains both the database and that file can read those keys. Whole-instance backups leave these keys out by default; they travel only in a passphrase-protected export and are re-encrypted to the target instance’s key on import.
   • A sandbox command receives credentials only through its own environment: the user’s connected-account tokens (for a skill command, only the issuers that skill declares) and one-time credentials approved for exactly that command are exported before it runs and removed when it ends, so the long-lived shell holds none between commands. The command can still read what it was given, so a credential handed to it is replaced by *** wherever its exact value appears in that command’s output (also when the output is read in pieces), and tool output passes through pattern-based secret redaction before it reaches the model. Neither is a guarantee for a value the command re-encodes (for example base64), a value shorter than 4 characters, or a secret with no recognizable shape.
4. Strict 127.0.0.1 Loopback Hardlock & Anti-DNS-Rebinding Shield:
   • Local services strictly bind to 127.0.0.1 by default. Robust CORS and LoopbackAuthToken enforcement prevent cross-site request forgery and DNS rebinding attacks against high-privilege local agents.

​

Multi-Platform Approval UX

• Permission: Allow all tools with this permission type (e.g., all file writes)
• Tool: Allow this specific tool regardless of arguments
• Exact: Allow this tool only with these exact arguments (default for shell tools — safest)
• Pattern (shell only): Allow commands matching a derived glob (e.g. curl -sS *). Compound shell (&&, |, ;) is never saved. All pattern rows appear in Settings → Allowlist and can be deleted anytime.

​

Batch High-Risk Confirmation & Safe-Only Security Splitting

• Deep Destructive Parameter Inspection: Harness batch_risk.py and frontend batchRisk.ts deeply extract payload.command, payload.args, and nested tool-call arguments, intercepting patterns like rm -rf, mkfs, DROP TABLE/DATABASE at sub-millisecond latency to prevent escape via generic bash tool names;
• High-Risk Confirmation Dialog (BatchHighRiskConfirmDialog): When a batch contains high-risk commands, smart denials (smartDenied), or forbidden permanent approvals, a modal prompt displays the exact risk reasons and affected items;
• Safe-Only Precision Splitting & Pre-Resume Fix: Users can choose “Approve Safe Only” — safe read-only operations resume immediately while high-risk destructive operations remain safely suspended for individual review. Client-side stream resume is strictly scoped to verified safeItemIds;
• Server HTTP 409 State-Machine Guard: When a Safe-Only batch contains 0 safe items, the API returns HTTP 409 Conflict (NO_SAFE_ITEMS_TO_APPROVE), preventing empty response ambiguity.

​

Socially Irreversible Action Gate (External Impact Defense)

• Accurate Action Identification: Covers git push (with complex path/force/pager flags), npm/pnpm/yarn publish, twine upload, docker/podman push, gh release/pr, and channel_notify/artifact_publish;
• Allowlist Bypass Prevention: These actions are stripped of the “Allow Always” privilege. Even if a broad pattern rule exists for shell_exec, socially irreversible commands are intercepted and demoted to single-shot HITL approvals;
• Prominent High-Risk Warning Banners: The approval card mounts a dedicated amber warning banner informing the user that remote environments will be modified upon confirmation.

​

Session-Scoped Denial Persistence & Auto-Mode Circuit Breaker

• Cross-Turn Registry: Consecutive (3) and cumulative (20) security denial counters are anchored to a persistent session registry rather than ephemeral coroutine ContextVars;
• Auto-Mode Suspension (AUTO_MODE_SUSPENDED): When breach thresholds are reached, Auto Mode is immediately suspended and a high-visibility warning banner surfaces on the WebUI approval card;
• Decay & Self-Healing: Explicit user approvals reset the consecutive counter and trigger self-healing decay on cumulative breaches (1 decay per 3 safe executions), ensuring a balanced balance between strict security and uninterrupted developer velocity;
• Session-Scoped Grant Isolation & Lifecycle Reclamation: Temporary tool approvals granted with “session” duration are strictly isolated in memory to the active session_id. When the session is purged (via Focus & Flush, chat deletion, or trash empty), clear_conversation_state automatically cascade-purges all ephemeral allowlist grants and resets denial counters, preventing dangling authorization leaks.

​

Sidebar Attention Indicator

• Amber pulse dot: Agent is waiting for your approval/clarification
• Green pulse dot: Agent is actively generating
• No dot: Session is idle

​

Approval Timeout Race Protection

• WebUI: Backend returns HTTP 409 → frontend shows a friendly toast and removes the stale approval card
• IM Channels: Agent replies with a localized message (EN/ZH) informing the user the approval was already handled
• Concurrent safety: Only the first resolver wins; all subsequent attempts are no-ops

​

Session Directory Authorization & Transparent Kernel Interception (Local & Desktop)

​

Rejections and Denial Tracking

• Rejections stay one-off: A rejection applies to that call only. For a permanent block, add a pattern to the Command Deny List in security settings
• Denial tracking: Repeated denials in one session suspend auto-mode, so every following action asks for explicit approval

​

Error Self-Healing

• Stream interruption recovery (stall detection, jittered-backoff retry, backup-model failover)
• Circuit breaker with 3-tier cooldown
• Model fallback chains
• Truncation auto-retry with progressive budget boost
• Deterministic fallback (LLM-free safety net)

​

Authentication & Health Monitoring

​

Session-ID Whitelist (Path-Traversal Guard)

​

Prompt Injection Defense

​

Content Boundary (Output-Side)

​

Intake Dangerous-Intent Safety Router (Pre-LLM Gate)

• Three High-Risk Dimensions: Flags MASS_DESTRUCTION (e.g., rm -rf /, DROP DATABASE, TRUNCATE TABLE, disk wipe), MASS_EXFILTRATION (bulk export of keys/credentials/.env), and PRIVILEGE_MUTATION (disabling safety barriers, sandbox escape).
• Dual-Tier Zero False-Positive Funnel: Strips Markdown code blocks and detects informational/code-generation syntax (e.g., “why drop table failed”, “write a cleanup script”) to guarantee 100% pass-through for benign software engineering questions.
• Per-Channel Handling: By default every channel prepends a [SAFETY_CAUTION] notice to a flagged prompt (hitl), telling the model not to run destructive changes without explicit confirmation. A host can set dangerous_intent_policy to fail_closed to replace a flagged prompt with a [BLOCKED_INTENT] notice, so the model never sees the original text. Unattended Cron runs add their own gates: untrusted-content injection screening is fail_closed, and tool calls are checked against the job’s declared capabilities, with anything undeclared denied.

​

Prompt Guard (Input-Side)

• Anti-obfuscation: Leet speak reversal, invisible Unicode stripping, whitespace folding, Base64 decoding
• Bilingual detection: English and Chinese prompt injection patterns (e.g., “忽略之前的指令”)
• Two-pass detection: First on normalized text, then on Base64-decoded content

​

Memory Write-Path Scanning

• Instruction-shape detection — guardrail-bypass orders and untrusted-channel writes are blocked (bilingual attack library)
• Credential zero-retention — API keys, passwords, PIN/OTP numeric credentials are redacted in place; years and phone numbers are excluded to avoid false positives
• Fake system-tag interception — System:/Assistant: colon prefixes are treated as injection
• Every write path shares the guard — manual stores, batch writes, updates, profile, rules, MCP tools, agent auto-extraction, and import recovery
• CI poisoning benchmark gate — two-layer expectation tests (detection layer + extraction layer) run in CI to prevent regression

​

File Lock Symlink Defense

​

Sub-Agent Security

​

Per-Agent Isolation & Access Visibility

1. Open each assistant and list its tools/MCP servers; remove anything the job does not need.
2. Open Settings → System → Saved Sessions; delete logins you no longer use and clean up expired sessions.
3. Check the assistant’s workspace/path policy: it should only read the project folders it needs.
4. Review Approvals and long-lived grants; revoke anything you do not remember granting.
5. Review the assistant’s cron jobs; delete paused or duplicate routines.

​

Skill Installation Security

​

Trust Levels

​

Runtime Permission Boundary

• Single source of truth: tool → permission type is resolved by the tool registry (resolve_permission_type), eliminating mapping drift that could turn a would-be denial into a silent allow.
• Grant once, execute unattended: already-granted permissions pass through without per-call popups; revokes take effect in seconds via the cache-invalidation callback, no restart required.
• Granular separation: sandboxed code execution (code_interpreter) and native shell (shell_exec) are authorized independently and cannot overstep each other.
• Full audit trail: every permission decision (allow/deny + target) is written to the permission usage log.
• Usage analytics dashboard: the audit log is aggregated into a visual dashboard — per-permission total/allowed/denied counts, exact denial reasons, and the latest 10 operations, filterable over 1/7/30/90-day windows. Abnormal behavior (e.g., a skill probing env vars repeatedly and getting denied each time) is visible at a glance, not buried in a raw log.
• Verification: 100% unit coverage of the skill boundary + real-DB end-to-end integration (grant → gate → execute → revoke → instant deny).

​

Trusted Source & Honest Sandbox Disclosure

• Silent direct-install backdoor removed: eliminates zero-interaction installation of single-URL imports to prevent supply-chain phishing;
• Environment-aware honest narrative: clearly indicates Local OS Permissions under Local/Desktop mode and Cloud Sandbox under isolated volume container deployments;
• Prompt injection and script execution warnings: educates users about indirect prompt injections attempting to exfiltrate secrets via bash;
• Physical checkbox gate (trusted-source-checkbox): the import button remains physically disabled until the user explicitly checks the trust confirmation box.

​

GUI Security Review

​

MCP Tool Security

​

MCP Server Config Scanning

​

Stdio Process Environment Variable Guard & Subprocess Credential Isolation Gate

• Static Pre-flight Blocking: Flags CRITICAL findings when high-risk variables (dynamic linker hooks, runtime injectors, proxy hijackers, git hooks) are detected in extra env params.
• Runtime Automatic Sanitization & Child Process Credential Isolation (ChildProcessCredentialTokenIsolation):
  • Automatically filters and isolates environment variables before any subprocess is spawned (env_isolation.py:build_isolated_child_env);
  • Physical removal of sensitive host credentials (NOISE_AUTH_TOKEN, CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN, AUTH_TOKEN, ACCESS_TOKEN, BEARER_TOKEN, DATABASE_URL, MYRM_VAULT_MASTER_KEY);
  • 8-dimensional pattern wildcards intercepting KEY, SECRET, TOKEN, PASSWORD, CREDENTIAL, AUTH_, _AUTH, AUTHORIZATION, AUTHENTICATION, BEARER, SIGNATURE;
  • Developer identity preservation: accurately distinguishes and preserves safe variables like GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL to avoid developer workflow disruptions;
  • Tri-state inheritance policies (CORE minimal safe whitelist / ALL filtered / NONE zero variables).
• Zero Prompt Cache Impact: Pure framework runtime execution with 0 token consumption.

​

Tool Name Isolation

mcp__{server}__{tool}

• Unambiguous parsing — Unlike single-underscore schemes, __ delimiters allow exact reverse parsing even when server names contain underscores
• Permission isolation — Prefixed MCP tool names never collide with built-in tools, preventing accidental permission bypass
• Audit traceability — Every tool invocation log entry identifies the originating MCP server

​

SSRF Prevention

• Unified outbound HTTP layer: All agent-initiated HTTP exits (web_fetch, HTTP tools, OpenAPI executor, skill ZIP install, media resolver, robots/sitemap fetch, channel media download, Feishu attachments) converge on secure_fetch / async_pin_url — one implementation, no bare httpx blind spots
• Manual redirect loop: follow_redirects=False with per-hop re-validation — every redirect target is fully checked before following
• DNS Pinning: Resolved IPs replace hostnames in HTTP connections, eliminating DNS rebinding TOCTOU attacks
• Comprehensive IP blocklist: RFC1918 private, CGNAT, link-local, multicast, reserved, cloud metadata endpoints (AWS/GCP/Alibaba/Tencent), plus IPv4-mapped IPv6 detection
• Data exfiltration detection: 6 pattern categories (API keys, file paths, base64, JWT, secret keys, DB connection strings) prevent sensitive data leaking through URL parameters
• Domain HITL approval: Non-allowlisted domains trigger human-in-the-loop approval when domainHitlEnabled is active — per-agent network allowlist configurable via UI
• Parser-confusing character defense: Tab, newline, and backslash in URLs are blocked to prevent hostname extraction divergence between parsers (CVE-class SSRF bypass prevention)
• Internal hostname suffix blocking: .local, .svc, .cluster.local, .home.arpa suffixes are blocked to prevent mDNS and cluster-internal service access
• Audit trail: Blocked requests emit SSRF_BLOCKED security decisions for SIEM and frontend audit views
• Agent API scope: /v1/chat/completions runs Myrm agents only (no raw LLM passthrough). User-configured Provider apiUrl SSRF checks remain on in-agent LLM calls — deploy-mode-aware: local mode allows loopback hosts (Ollama/vLLM), cloud/sandbox mode blocks private networks and cloud metadata endpoints
• 461+ dedicated SSRF tests: Coverage across core guards, agent security, browser navigation, DNS pinning, media validation, web fetch, SessionVault, permission engine, and provider URL validation

​

Malicious URL Architectural Immunity

• SessionVault domain binding: Credentials (cookies/passwords) are strictly isolated per domain — bank.com login state is never sent to phishing domains like bank-secure-login.xyz, eliminating credential theft by design
• Agent-level session isolation: Each configured agent gets its own physical SessionVault subdirectory — a “Work Assistant” and “Personal Assistant” accessing the same website maintain completely independent login states, preventing identity pollution across agents
• Browser sandbox isolation: Agent browsers run in isolated sandboxes — even if a malicious site is visited, the user’s host system is unaffected
• Four-layer deep domain filtering: CSP policy (kernel-level network restriction) + protocol interception (context.route blocks non-allowlisted domains) + main thread hardening (WebRTC/WebTransport/ServiceWorker blocking) + CDP audit monitoring

​

Configuration Security Scan

​

Malicious Package Detection

​

Dynamic Tool Change Safety

• Automatic security vetting — Newly added tools are evaluated against the same 13-threat security scan applied at configuration time. If a tool fails the check, it is rejected and a warning is logged — no unsafe tool is ever silently activated
• Prompt cache preservation — The agent’s prompt-facing tool list is frozen; dynamic changes only update the internal execution layer. This guarantees prompt prefix cache hits are never invalidated by external MCP server behavior
• Zero user interruption — Unlike CLI-based competitors that require manual /reload confirmation, Myrm handles tool changes transparently. Users are never interrupted with confirmation dialogs for events they cannot meaningfully evaluate

​

Per-Agent Tool Filtering

​

Built-in Tool Governance Gate

• Zero silent bypass — a newly added built-in tool with no permission mapping, no dynamic-resolution declaration, no auto-approval entry, and no explicit mcp_invoke fallback fails the build. It can never quietly fall back to an ambiguous runtime default.
• Explicit three-state model — each tool is either explicitly auto-approved (read-only), explicitly mapped to a permission type (governed by the ruleset), or explicitly declared as an mcp_invoke fallback that keeps the ask-by-default baseline (high-risk tools such as browser_execute_script_tool and send_teammate_message_tool).
• Bidirectional consistency — declarations are cross-checked both ways: BUILTIN_TOOL_NAMES must be a subset of the registered universe (a declaration without an anchor fails), and permission-type whitelist entries must not be stale (now covered by DEFAULT_RULESET) or orphaned (no tool maps to them). The audit report can never contradict the code.
• Dynamic-resolution SSOT — tools whose permission type is resolved per-action (browser interaction, desktop control) declare their dynamic branches from a single source of truth, and the gate consumes that source instead of a duplicated list.
• Module-load safety gate — every built-in tool must declare safety metadata (read-only / destructive / concurrent-safe); a missing declaration is flagged at import time, not discovered in production.

​

Operation-Level Semantic Risk Detection

​

7-Category Semantic DOM Risk Detection

• Zero maintenance: No need to maintain a list of “high-risk websites”
• Universal coverage: Works on any website, including new ones
• Granular: “View cart” on Amazon passes automatically, but “Place order” requires approval
• No legal risk: No discrimination against specific platforms

​

Smart Intent Guard

• Reasoning-Blind: Only sees user messages + tool call sequences (not agent reasoning), preventing self-justification attacks
• Deterministic: temperature=0 ensures identical inputs always produce identical verdicts
• Structured output: Pydantic-enforced JSON with a reason field for audit traceability
• Fail-safe: Errors or ambiguity fall back to HITL rather than auto-approving

​

Risk Governance System

​

Test Coverage

​

Shell Command Security

​

AI Trajectory Classifier (Layer 5.5)

• Reasoning-Blind design: Only sees user messages and tool call sequences — never assistant reasoning or tool outputs, preventing the agent from rationalizing dangerous actions past the classifier
• Structured output: Pydantic schema forces JSON format (not free-text), reducing injection surface
• Deterministic: temperature=0, max_tokens=200 for reproducible decisions
• Fail-safe: Any error, timeout, or parse failure returns UNCERTAIN → falls back to HITL approval
• Context-aware: Receives taint labels (EXTERNAL_NETWORK, SECRET) and trusted domains for nuanced judgment

​

Bilingual Command Explanation

• 73 common commands covered with parameter-aware descriptions (extracts URLs, filenames, package names)
• sudo prefix auto-tagged, dangerous pipe patterns highlighted
• Users understand what the command does before approving, even without shell expertise
• Entirely rule-based: cannot be manipulated via prompt injection unlike LLM-based alternatives

​

Install Slopcheck (Anti-Slopsquatting)

​

Encryption & Enterprise Network Compatibility

​

Enterprise TLS Compatibility

• Settings → Preferences → Advanced Settings → Enterprise Network Compatibility, or set MYRM_TLS_STRICT=0; the change takes effect after the app restarts
• Precision relaxation: certificate chains are validated against the operating system’s trust store (where administrators push the inspection root) plus any CA bundle named by SSL_CERT_FILE, REQUESTS_CA_BUNDLE or NODE_EXTRA_CA_CERTS (added to it, never replacing it; the connection to a remote MCP server reads SSL_CERT_FILE only), and only Python 3.13+‘s VERIFY_X509_STRICT flag is cleared — chain, hostname and expiry checks stay on, so it does NOT disable certificate verification
• Covers the chat-model transport, the S3 remote backup, the Email channel’s IMAP and SMTP connections and the Python HTTP clients the agent uses (httpx, aiohttp, requests, urllib); MCP servers built on Node.js (for example those started through npx), the WhatsApp channel’s bridge and its dependency install, the install step of external CLI agents and the agents’ own processes are told to use the system trust store as well (Node 22.19+ and 24.6+ understand the hint; an older Node ignores it)
• The bundled email skill (imap-smtp-email) runs its script in a separate process that this setting does not reach. The script verifies the mail server’s certificate against Python’s default CA bundle (on macOS a file, not the system keychain) and honours SSL_CERT_FILE only. There SSL_CERT_FILE replaces the default bundle instead of adding to it, so the file must also contain every public CA the script still has to trust; set it in the environment the agent server runs in. A rejected certificate is reported with this hint and is never skipped
• Per-MCP-server TLS: each MCP server can specify its own ssl_verify (true/false/custom CA path) and client_cert/client_key/client_key_password for full mTLS
• How the setting reaches each client: the infra module tls_compat.py installs the trust policy when the app starts, and the server’s tls_config.py carries the Preferences switch over to MYRM_TLS_STRICT. The policy applies where a client takes its TLS context: ssl.create_default_context() (httpx, urllib, asyncio, and the Email channel) and the context builders of requests and aiohttp, so none of these needs a switch of its own; the S3 remote backup, whose client library builds its own context, reads the setting directly
• Automatic TLS error diagnosis: tells a rejected certificate chain from an interrupted handshake, with remediation hints in 5 languages
• TLS-specific test coverage: the TLS compatibility core, per-MCP-server TLS (live integration) and TLS error diagnosis

​

Incognito Mode Deep Dive

• Event log: no per-session event log is written, so prompts and tool results are not copied to disk outside the chat database
• Server layer: Skips memory manager binding and all memory tools (memory_search_tool, memory_save, memory_manage), disables memory context injection, archive checkpoints, and session cleanup callbacks
• Uploads follow the chat: files attached in an incognito chat are bound to it, removed with it, kept out of exports and backups, and hidden from other chats’ @ suggestions
• Database layer: the is_incognito flag keeps the session out of the sidebar, full-text search, session recall, the Catchup Inbox and the memory export, and no title or message preview is stored; the messages stay in the local database until the session has been idle for an hour, then the session is permanently deleted with its attachments
• Self-hosted: chats are stored on your own deployment rather than on a vendor server; the model provider you configure still processes what each turn sends, incognito or not

​

Credential Protection

​

Form Credential Vault

​

Zero-Plaintext External Secrets Vault & Dynamic Rotation (1Password & Bitwarden)

1. Native Secret URI Resolution:
   • Supports op://<vault>/<item>/<field> (1Password CLI / Connect API), bw://<item-id> (Bitwarden CLI), and bws://<secret-id> (Bitwarden Secrets Manager).
   • Database records store only reference URIs — zero plaintext secrets ever touch persistent disks.
2. Single-Flight Dogpile Prevention (_FlightCall):
   • High-concurrency agent workflows resolving the same credential concurrently are coalesced into a single resolution call, completely eliminating CLI process storms and locking deadlocks.
3. In-Memory TTL Caching & 401 Dynamic Rotation:
   • Resolved credentials are kept strictly in-memory with a configurable 600s TTL.
   • Upon encountering HTTP 401/403 authorization failures during API calls, the gateway instantly invalidates cached tokens and transparently re-resolves the rotated secret, guaranteeing uninterrupted long-running task autonomy.
4. Non-Interactive Execution Isolation (_build_noninteractive_env):
   • Resolvers strip all interactive prompts, desktop notifications, and GUI popups, enforcing deterministic non-blocking execution in headless backend and CI/CD environments.
5. Command-Scoped Delivery:
   • A resolved secret reaches a sandbox command only through that command’s environment and is removed when the command ends; the shell itself starts with no credentials. Commands of one conversation share that shell, so this limits what is delivered; it does not contain a command that deliberately tampers with the shell (for example by installing a trap).
6. Rigorous Verification:
   • 92.1% statement coverage across core/security/external_secrets/ from its 10 harness unit tests, all passing (measured with pytest --cov, 2026-10-28).
   • 100% Chrome real-browser E2E verification (test_external_secrets_settings_chrome_e2e.py executed in exclusive isolation, 1 passed in 248.02s).

​

Leak Detection

• API keys (OpenAI, Anthropic, AWS, GCP, Azure, etc.)
• Database connection strings
• JWT tokens and session IDs
• SSH private keys
• Entropy-based detection for unknown credential formats

​

PII Redaction & Privacy-Aware Routing

• Regex PII Scanner: 12+ structured types (phone, ID card, passport, bank card with Luhn validation, SSN, email, address, courier number, private IP, etc.)
• LLM Semantic Scanner: 20+ non-structured types (medical health, political views, financial records, precise locations, biometrics) with PL2/PL3/PL4 classification
• Credential Leak Scanner: 25+ secret patterns (AWS, OpenAI, Anthropic, GitHub, Slack, JWT, PEM keys, etc.) with Shannon entropy analysis

​

Data Flow & Privacy Disclosure (Settings)

​

Summary Path Protection

​

Taint Tracking

​

Agent Export & Import Security

• Every skill goes through the full install pipeline and a whole-file security scan; a skill with a clean SKILL.md but a malicious script is rejected and leaves nothing behind.
• Agents can only narrow their own permissions, and a package never carries security policy: security_overrides, default_security_preset, trusted_desktop_apps and other machine-local fields are dropped on import. Tool grants are limited to the default set and the loop budget cannot exceed the system default.
• MCP servers are imported disabled; you enter the keys yourself, they are never read from the package.

​

Privacy-safe Rule Sharing

• Path anonymization — user home directory paths are replaced with <USER> placeholders
• Credential redaction — API keys and secrets are truncated to safe prefixes (e.g., sk-pro...f456)
• Metadata stripping — timestamps, update counts, and internal IDs are removed from exported rules

​

Password-Protected Sharing

​

Revoke anywhere, instantly — and it stays revoked

​

What a conversation link shows

​

Agent Secret Management — Zero Plaintext Exposure

​

Audit Trail

​

Structured Audit Trail

• 37 typed security decisions (ALLOW, DENY, ASK, SSRF_BLOCKED, PII_REDACTED, TAINT_ESCALATE, etc.)
• Prometheus policy_denial_total counter for real-time anomaly detection
• Session-scoped accumulator with TaintTracker cross-tool information-flow tracking
• Cron job metadata automatically embeds the full security audit for post-run analysis

​

Event Types

• TOOL_CALL_START / TOOL_CALL_END
• APPROVAL_REQUESTED / APPROVAL_GRANTED / APPROVAL_DENIED
• MODEL_SWITCHED / FALLBACK_ACTIVATED
• ITERATION_LIMIT_REACHED / BUDGET_EXHAUSTED
• LOOP_DETECTED / CANCELLED
• COMPRESSION_TRIGGERED / CHECKPOINT_CREATED

​

Profile Audit Engine

• Score: 0–100 (higher = safer), deducted per finding severity
• Risk Level: Safe / Low / Medium / High / Critical (5-level color-coded)
• 6-Dimension Grouped View: Findings grouped by checker dimension with per-dimension color coding — expand any dimension to see individual findings with severity borders, titles, and actionable recommendations
• One-Click Fix: Policy gap findings include Fix (toggle switch) or Configure (navigate to settings section) buttons for immediate remediation

​

Six Detection Dimensions

​

Design

• Zero LLM: Pure deterministic rule engine — no token cost, instant response
• Plugin architecture: Each checker implements BaseChecker and can be extended independently
• Auto-refresh: Results update automatically when you save Agent configuration changes
• Framework-level: Available to any project using the harness engine, not just the product UI
• Test coverage: 37 backend unit tests + 15 frontend component tests (52 total)

​

Workspace Rules Security

• Root files: .myrm.md, AGENTS.md, CLAUDE.md, SOUL.md, .cursorrules, .clinerules, .windsurfrules, and their case variants
• Subdirectories: .myrm/rules/*.md, .cursor/rules/*.mdc, .claude/CLAUDE.md, .github/copilot-instructions.md
• First-Match-Wins: Only the highest-priority file loads per directory, preventing conflicts
• Zero-config migration: Users from Hermes (SOUL.md), Cline (.clinerules), Cursor (.cursorrules), Claude Code (CLAUDE.md), Windsurf (.windsurfrules) can bring their rule files unchanged

• 113 detection patterns across 26 threat categories
• Anti-obfuscation: Leet speak, invisible Unicode, whitespace folding, Base64 decoding
• Chinese injection detection: Supports CJK character-based prompt injection
• Blocked content is replaced with a [BLOCKED] placeholder with structured metadata

​

Emergency Controls

​

Security Dashboard

• Setup Panel: Guided configuration of webhooks, monitored repos, and GitHub tokens
• Multi-source: Pulls data from GitHub, Control Plane, or merged sources based on deployment mode
• One-click refresh: Real-time data reload per tab
• Export: Audit logs exportable in CSV or JSON format for SIEM integration

​

Smart Approval (Auto Mode)

• Classifier errors → fall back to HITL (never auto-approve on failure)
• temperature=0 for deterministic, reproducible decisions
• Pydantic-enforced structured output (no free-text manipulation)
• Taint labels injected for context-aware judgment

​

Smart DENY → User Override (Once)

​

High-Risk Scenario: Always Allow Hidden

​

Command Denylist (User-Defined Hard Floor)

​

Memory Write Trust Isolation

​

Security Profiles: One-Click Safety Modes

​

Cron Job Execution Policy (Per-Job Least Privilege)

• Fail-closed by default — jobs without explicit capability declarations deny dangerous operations (shell, code execution, MCP) automatically. A warning banner guides users to configure the capability fence or enable YOLO mode per-agent.
• Preset packs (web-only / research / devops) dual-write capability fence + tool scope, aligned with blueprint SSOT.
• Read-it-Later blueprint uses router mode (__wiki_source_sync__) with empty tools — deterministic server-side pull, zero LLM agent turns, no browser or code execution.
• Lifecycle guard rejects cron prompts/commands/pre-flight probe scripts/shell acceptance criteria containing Myrm restart/stop or pkill myrm-agent patterns — prevents self-inflicted outage loops.
• Restricted jobs do not silently gain baseline tools — a file-only cron will not auto-enable code_execute; unrestricted jobs still inherit the Agent baseline.

​

Subagent Recursive Isolation: 5-Layer Defense

​

Multi-Agent File Protection: 6-Layer Defense

1. A parent agent delegates 3 coding tasks to parallel subagents
2. All three work in the same workspace — no copies, no merge step
3. Before each write, file_activity_tracker is checked for another agent’s recent edits to the same file
4. If the line ranges overlap, file_conflict_guard blocks the write; an edit to another region of the same file only produces a warning
5. When a subagent finishes, subagent_manager clears its tracking records

​

vs CaMeL Guard (hermes-agent-camel)

​

Skill Quarantine Sandbox & Atomic Installation

1. Quarantine Sandbox Directory: Remote skills (Git or ZIP) are extracted and staged in an isolated temporary directory before touching the active workspace.
2. Path Traversal Containment: All relative paths inside skill packages are sanitized against the sandbox boundary, blocking Zip Slip and relative directory escape attempts.
3. Pre-Activation Security Gate: Regex, AST, and LLM semantic security checks run entirely inside the quarantine directory. Rejected packages are purged without touching disk storage.
4. Atomic Replace with Automatic Rollback: Installations and upgrades create a .bak backup and perform an atomic swap. File system IO errors trigger an instant rollback to the previous version.
5. Fault-Tolerant Multi-Source Search: Aggregated skill registry queries run with per-source timeouts and fault isolation, preventing slow or failing registries from hanging the discovery UI.

​

Anti-Contamination & Canary Protection Gate

1. Dynamic Canary Token & GUID Dual-Track Protection: Automatically detects and injects benchmark Canary watermarks (CANARY_GUID and dataset-specific canary_token).
2. In-Episode Outbound Search Sanitization: Intercepts and scrubs Canary watermarks in outbound search/fetch queries in real time, preventing benchmark prompt leaks to external search engines and training corpora.
3. Pre-Run Workspace Cleanliness Verification: Recursively scans agent workspaces prior to evaluation turns to ensure ground-truth patches and hidden verification files are physically excluded from live environments.
4. Trajectory Anti-Cheating & Secret Probing Defense: Scans agent tool execution trajectories for attempts to probe hidden verification paths (/hidden_tests/, verifier.toml) or dump shell environment variables/secrets (printenv, export, /proc/*/environ). Violations trigger an immediate FAIL with structured diagnostic reports.
5. End-to-End Visual Violation Transparency: Surfaced directly in the WebUI with Canary verification status and detailed violation diagnostic cards.

​

Channel & Operator Scoped Memory ACL (Anti-Poisoning & Anti-Leakage Gate)

1. Write-Plane Poisoning Prevention (allow_shared_write=False): Tool-layer physical intercept automatically downgrades any attempt to write to shared global memory into bound (current session scope), preventing untrusted channel participants from poisoning organizational shared knowledge.
2. Read-Plane Recall Isolation (default_scope="same_source"): Server-side conversation provider forcibly locks conversation history searches to the same source channel, blocking malicious prompt injection attacks from cross-recalling private WebUI conversations, credentials, or personal workflows.
3. Zero Prompt Token Overhead & 100% Cache Preservation: Enforced entirely at the runtime execution layer with static tool descriptions, preserving full prompt cache hit rates.

​

Agentic Code Security Scan (Verify-then-Report Skill)

1. Verify-then-Report Dynamic PoC Validation: In contrast to traditional SAST tools that flood developers with false positives, the skill requires a minimal Proof-of-Concept (PoC) exploit to run in the sandbox before a Critical or High finding is reported. Candidates whose exploit fails are discarded or downgraded to informational, eliminating alert fatigue.
2. AST Incremental Slicing: Slices diff contexts to under 300 lines to maximize prompt cache hit rates.

​

Control UI Surface Error Redaction

1. Dual-Tier UI & API Filtering: The frontend errorRedactor.ts intercepts all toast.error, toast.warning, and API Client error pipelines, automatically masking high-entropy API keys, Bearer/JWT tokens, and database URI passwords.
2. Local Path Normalization: Replaces sensitive local developer paths (e.g., /Users/username/... or /home/username/...) with ~/..., preventing internal user directory disclosure.
3. Server-Side Serialization Safety Net: FastAPI global exception handlers (errors.py) sanitize error messages and details before dispatching JSON responses to clients.

​

Approved Scripts TOCTOU Drift Guard

1. Evaluation Snapshot Locking: When a user approves an external script command (e.g., python script.py), the Harness extracts the script operand and records its SHA-256 content hash snapshot during the security evaluation phase.
2. Execution-Boundary Revalidation: At the execution boundary (apply_approval_decisions), the file’s current SHA-256 hash is recomputed. If the script was modified, overwritten, or symlink-swapped while awaiting user approval, it triggers SCRIPT_OPERAND_DRIFT_REJECT and halts immediately.
3. Hide Allow Always: Commands involving dynamic external script operands automatically suppress the “Always Allow” option, blocking malicious attackers from leveraging existing allowlists to run unreviewed code.

​

Frontend Chart SVG Strict Sanitization (Mermaid Preview)

1. Strict Engine Configuration: Forces Mermaid rendering configuration to securityLevel: 'strict' and htmlLabels: false, disabling inner HTML script execution vectors.
2. Recursive DOMParser Attribute Sanitization: Recursively inspects the rendered SVG DOM tree using sanitizeMermaidSvg, stripping dangerous tags (<script>, <foreignObject>, <iframe>, <object>).
3. Neutralized Inline Events and Pseudo-Protocols: Strips all case-insensitive on* inline event listeners and purges href / xlink:href attributes containing pseudo-protocols, ensuring complete immunity against Stored XSS across chat bubbles and fullscreen modal views.

​

Plugin Packaging Integrity Guard

1. Static Ingestion Verification: Statically verifies referenced local build artifacts and entrypoint scripts (node dist/index.js, python server.py, ./bin/server) at archive ingest time against the package files.
2. Component-Level Localized Fault Isolation: Automatically skips broken MCP servers while allowing functional Skills and Agents to install smoothly, preventing a single unbuilt component from halting the entire import workflow.
3. Adaptive Flag Stripping and Normalization: Strips interpreter flags (-u, --loader), normalizes Windows backslashes and ${PLUGIN_ROOT} macros, and detects bare relative entrypoint arguments (args: ["dist/index.js"]).
4. GUI Hardening and Accidental Install Protection: Surfaces clear warning badges with actionable build instructions (e.g., npm run build), defaults broken servers to skip, and protects against accidental bulk installs.

​

Child Process Credential Token Isolation

1. Tri-State Inheritance Policies (SSOT):
   • CORE: Strict POSIX and runtime whitelist (preserves PATH, HOME, USER, developer tools, and GIT_AUTHOR_* identity while stripping all sensitive tokens).
   • ALL: Full environment inheritance accompanied by 57 dynamic linker/proxy hijacking blocklists and 8-dimensional sensitive token wildcards.
   • NONE: Complete environment isolation with zero inherited variables.
2. 100% Execution Surface Coverage: Applied across persistent shell sessions, Python subprocesses, background daemons, browser sandboxes, and CUA execution environments.
3. Zero False Positives for Toolchains: Intelligently distinguishes credential patterns (AUTH_TOKEN, API_KEY) from developer authorship metadata (GIT_AUTHOR_NAME, GIT_COMMITTER_EMAIL), guaranteeing smooth Git commits and local developer workflows.

​

Zero-Key Subprocess Sanitization vs MITM Proxy

1. Fail-Closed Physical Sanitization: Strips all sensitive credentials at child environment creation time, ensuring printenv in subprocesses can never expose plaintext secrets.
2. In-Memory Controlled LLM Invocation: Agent core inference connections are established directly within the runtime memory without proxy overhead, eliminating CERTIFICATE_VERIFY_FAILED errors.
3. Dedicated Agent-in-Sandbox Isolation: Leverages dedicated volume isolation and containerization, providing true multi-tenant physical boundaries with zero configuration friction.

​

Deterministic Execution-Defense vs Jailbreak Red-Teaming

1. Untrusted Data Envelope: Wraps untrusted external data (web content, attachments) in strict physical envelopes, stripping instruction privileges at the system prompt protocol layer to defeat indirect injection.
2. Non-Bypassable Layer 1–5 Onion Physical Guard: Bypasses fragile, slow, and evadable external LLM evaluators by enforcing fail-closed physical barriers at the system call boundary. Even if a model is semantically jailbroken, destructive operations and credential exfiltration are physically halted before OS execution.
3. Immutable Causal Audit Trail: Tracks all tool calls, approval decisions, and blocks with tamper-evident cryptographic metadata, fulfilling enterprise compliance and auditability requirements out of the box.

​

Kernel-Level Sandbox & Supply Chain Defense (Bubblewrap / Seatbelt & Google OSV)

1. Agent-in-Sandbox Kernel Isolation (Linux Bubblewrap & macOS Seatbelt): All code execution runs in dedicated kernel-level namespaces (--unshare-user, --unshare-pid, --unshare-net). Root filesystem is mounted read-only (--ro-bind /usr), and host credentials (~/.ssh, ~/.aws) are physically unmapped (ENOENT).
2. Default-Deny Network Boundary: Sandbox code execution is strictly network-isolated (--unshare-net) by default. Malicious CVE payloads cannot reverse-shell or exfiltrate local data.
3. Google OSV.dev Intelligence & Offline Advisory Catalog: Combines real-time Google OSV.dev CVE batch queries (osv_scanner.py) with offline known-compromised package catalogs (security_advisories.py) and install-script audits (package_audit.py).

​

Enterprise Outbound Proxy & Loopback Exemption

1. Native Asynchronous Network Stack (httpx): Fully inherits system HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY without fragile Node.js-style global dispatcher patches.
2. Mandatory Loopback Exemption (Anti-Deadlock Invariant): Automatically injects localhost, 127.0.0.1, and ::1 into bypass rules, completely preventing local UI, WebSocket, and IPC traffic from routing into external proxies.
3. Enterprise TLS Inspection Compatibility (tls_compat.py): Trusts the operating system’s certificate store plus the CA bundles you name and relaxes only VERIFY_X509_STRICT for corporate proxies, without disabling certificate chain verification, eliminating SSL handshake errors across the agent’s Python HTTP clients.
4. Child Process Proxy Credential Scrubbing: Strips embedded basic-auth proxy passwords before passing environments to untrusted workers, defeating credential extraction attacks.

​

Protected Instructions & Anti-Persistence Injection Shield

1. Protected Instruction Hardening: Core steering assets including AGENTS.md, SOUL.md, CLAUDE.md, and .cursorrules are registered under protected path defense (path_security.py). Any mutation attempt forfeits “Allow Always” exemptions and triggers mandatory Monaco Diff approval cards.
2. Kernel Read-Only Mounts & Shell AST Redirect Veto: In sandbox environments, steering files are mounted read-only (--ro-bind). In shell executors (shell_command_analyzer.py), AST-driven full-pipe parsing vetos redirection commands (echo > AGENTS.md, sed -i, tee), halting persistent jailbreaks at the system boundary.
3. Zero-Disk OS Keychain Custody of the Vault Master Key, AES-256-GCM Ciphertext for Saved Keys: The agent vault’s master key is delegated to the OS keyring (macOS Keychain, Linux SecretService, Windows Credential Manager). Keys saved in settings (model providers, search, MCP, channel credentials, the local-model key) are stored in SQLite only as AES-256-GCM ciphertext; their encryption key comes from an environment variable or a mode-0600 .encryption_key file in the state directory, not from the OS keychain, so a copy of the database without that file does not expose them.

​

Multi-Channel DM Session Enclave & Anti-Poisoning Gate

1. 4-Tuple Physical Session Enclave (routing_enclave_key): Strictly isolates sessions via (tenant_id, channel, peer_id, agent_profile_id), physically preventing conversation cross-talk and data leaks across tenants, channels, senders, and multi-agent personas while seamlessly maintaining backwards-compatible 2-tuple parse_enclave_key resolution;
2. Stranger Privilege Escalation Defense Gate (Anti-Privilege Escalation Gate): Closes the critical vulnerability in OPEN policy where unpaired senders automatically fell back to inheriting default_user_id (sandbox superuser privileges); unpaired senders are strictly assigned isolated guest identities (guest_{channel}_{sender_id}) with zero access to privileged execution tools;
3. Long-Term Memory Anti-Poisoning Fence (Anti-Poisoning Fence): Directly validates authentication state in the inbound persistence pipeline record_inbound; visitor and unpaired messages are strictly stamped with learning_eligible=False, physically blocking prompt injection attempts from polluting long-term memory and vector indices.

​

Controlled Micro-budget Autonomous Payment & Spending Limit Vault (Commerce)

1. Deterministic SpendGovernor Pure State Machine (spend_governor.py):
   • Zero External I/O: Designed as a pure state machine decoupled from specific payment providers, ensuring minimal latency and zero vendor lock-in.
   • Integer Cents Accounting: Replaces vulnerable floating-point math with exact integer cents (cents: int), completely eliminating rounding errors and cumulative precision drifts across concurrent transactions.
   • Dual Hard Limits: Enforces strict per_transaction_limit_cents and daily_limit_cents thresholds. Any over-limit attempt is physically blocked and flagged as APPROVAL_REQUIRED.
   • Merchant & Category Whitelists: Restricts payments strictly to approved domains (supporting wildcards like *.api.stripe.com) and service categories (api_compute, dataset, etc.), defeating malicious prompt injections attempting to transfer funds to adversary accounts.
   • UTC Calendar Day Atomic Rolling & 3600s Lease Compaction: Atomically rolls daily counters at midnight UTC (YYYY-MM-DD), preventing 24-hour sliding window deadlocks; automatically evicts finalized COMMITTED/RELEASED leases older than 3600s to avoid memory leaks.
2. Two-Phase Idempotent Lease Commit/Release:
   • Idempotency-Key Pre-allocation: Enforces idempotency_key deduplication, allowing safe retries across flaky networks without duplicate holds.
   • HMAC-SHA256 Cryptographic Lease Signatures: Generates tamper-proof lease signatures (hmac_sha256(lease_id + amount + ts)). Tampered lease IDs or falsified payment amounts are rejected instantly.
   • Hold/Commit/Release Lifecycle: Pre-allocates funds on hold, accurately reconciles final charged amounts, and guarantees immediate fund release on task cancellation.
3. Offline Persistent Ledger & Crash-Resilient Boot Reconciliation (spending_ledger.json):
   • Cold-Boot Self-Healing (restore_daily_spent): Upon server boot, BudgetService scans local committed transactions for the current UTC day and restores the exact daily spent watermark into SpendGovernor. This eliminates the critical reboot-bypass vulnerability where adversaries induce crashes to reset spending counters.
   • WebUI Spending Vault & Emergency Freeze: Provides real-time budget utilization gauges, merchant allowlist management, and an instant one-click Emergency Freeze trigger to halt all active payment channels.
4. Competitive Parity vs. Six Major Frameworks:
   • Unlike Hermes, OpenClaw, Codex, DeepSeek-Harness, Pi, and OpenCode—which either completely lack micro-payment sandboxes or expose raw credentials to LLM prompt injection—Myrm provides the industry’s first defense-in-depth commerce spending safety suite, backed by 100% statement test coverage.

​

Session Canary

• Per-session token: every agent session gets a random CANARY-... token. It is appended to the system prompt together with an instruction never to repeat it, so the system prompt differs from session to session;
• Leak detection: after every model turn the guardrail checks the reply text and the tool-call arguments for the token. A hit is recorded in the audit log as CANARY_LEAKED and the token is scrubbed from the reply text. Tool calls are not blocked.

​

Irreversible Destructive Action Hard Stop Line & Workspace Snapshot Rollback Suite

​

1. Bash AST Syntax Tree Hard Stop & Blast Radius Classification

• Deep Syntax Tree Semantic Inspection: The Harness engine parses full command pipelines, compound sequences, and inline scripts using a zero-dependency lexical state machine and AST analyzer (destructive_rules.py, 386 lines), preventing evasions via environmental prefixes or nested quotes;
• Deterministic Capability Level Escalation: Irreversible operations are physically classified into CapabilityLevel.IRREVERSIBLE_DESTRUCTIVE;
• Stripping ‘Allow Always’ & Mandatory Explicit CONFIRM Typing: Destructive approval cards unconditionally strip and disable allow_always privileges to prevent permanent bypass backdoors. The front-end renders a fiery red alert banner (DestructiveConfirmationBanner), requiring the user to explicitly type CONFIRM before the approve button activates;
• YOLO Mode Hard Veto: Destructive action hard-stops hold supreme physical priority over --yolo autonomous flags, guaranteeing that destructive operations can never execute unsupervised.

​

2. Zero-Copy Millisecond-Level Workspace Snapshotting

• Isolated Temporary Index via GIT_INDEX_FILE: In the millisecond window before an approved destructive action runs, workspace_snapshot.py builds an isolated temporary Git index (git read-tree HEAD -> git add -A -> git write-tree -> git commit-tree);
• 100% Untracked New File Capture: Unlike standard git stash, this isolated temporary index captures all untracked and modified files with zero race conditions, committing a dedicated snapshot ref (refs/myrm-snapshots/{snapshot_id});
• Zero Disk Copy Overhead & Worktree Cleanliness: Operates without copying large directories or polluting the developer’s working stage, adding less than a few milliseconds of runtime overhead.

​

3. 10-Minute Dynamic Countdown & Anti-Penetration Rollback Gate (600s TTL)

• Dynamic Countdown Undo Card (DestructiveUndoCard): Once a destructive action executes, the WebUI immediately mounts an interactive undo card featuring a 10-minute dynamic countdown with strict Lucide vector icons and dual-theme responsive styling;
• Server 600s TTL Physical Guard: The POST /api/v1/approvals/{id}/rollback endpoint enforces a strict 600-second time-to-live ceiling, physically rejecting stale rollback attempts to prevent accidental corruption of subsequent intended work;
• Instant Lossless Reversion: Clicking “Undo & Rollback Workspace” atomically restores the entire workspace state back to the exact pre-execution snapshot, completely reversing accidental deletions in milliseconds.

​

4. Empirical Evidence & Competitive Parity vs. Six Major Frameworks

• Full Spectrum Comparison (Myrm vs. Hermes / OpenClaw / Codex / DeepSeek-Harness / Pi / OpenCode):
  • Hermes / OpenClaw / OpenCode: Lack destructive classification; prompts can wipe repositories unsupervised in auto/YOLO mode;
  • Codex CLI: Offers simple terminal prompt prompts with zero workspace snapshotting or undo mechanisms;
  • Myrm: The industry’s first holistic defense suite combining Bash AST hard stops, mandatory CONFIRM typing, zero-copy snapshots, and 10-minute TTL anti-penetration rollback;
• Quality Gates & Test Coverage:
  • Harness unit and security suite: 32/32 tests passed (2.85s) with 244 total security tests green;
  • Server endpoints and integration suite: 5/5 tests passed, with 338 server tests green;
  • Frontend Approval components: 30/30 tests passed with 1,840 modules and 0 orphans;
  • Real Chrome CDP browser E2E test test_pending_approvals_chrome_e2e.py: 100% pass (1 passed in 165.59s, zero mock).

​

15. Object-Capability (OCap) Zero-Trust Delegation Mesh & Capability Attenuation Suite

​

1. The Death of Ambient Authority in Multi-Agent Systems

• Hermes / OpenClaw: Restrict a subagent through tool allow and deny lists (delegate_tool_toolsets.py, delegated-tool-policy.ts); which paths an allowed tool may touch is not bounded per spawn;
• Claude Code / Codex: A subagent inherits the parent’s permission mode or sandbox policy, so the boundary belongs to the session rather than to each spawn;
• Myrm: Employs Object-Capability (OCap) delegation, issuing every delegate_task subagent (single and batch modes) an unforgeable HMAC-SHA256 capability handle that the local file and shell executors enforce on each operation. Council, alternatives and Dynamic Workflow children do not receive one. Among the products we reviewed, none binds a per-spawn, path-scoped signed capability.

​

2. High-Performance Architecture Innovations

1. Unforgeable Token Signing & Scoped Confinement: Each subagent runs under a signed handle scoped to its parent’s own workspace plus any extra directories the parent’s path policy and the user’s session grants already allow, whether a path is given directly or through a symlink; the model’s own context never becomes the child’s runtime context. A spawn from an already confined parent is attenuated from the parent’s handle (attenuate_capability rejects any elevation with AttenuationError), so a child never exceeds its parent and a read-only parent only spawns read-only children. A read-only subagent is denied writes and shell execution, and an expired or tampered handle is denied. The handle bounds file operations to the granted paths and locks shell commands to the granted working directory; the command text itself is checked by the command validator, and strong isolation of what a command can reach is the job of the OS or cloud sandbox;
2. Stateless Validation (CWE-400 Proof): Handle validity is a signature and expiry check, so the framework retains nothing per spawn: there is no registry to grow, prune or leak in a long-running daemon;
3. Hierarchical Path Escape Defense (CWE-59 Proof): Combines lexical normalization with physical topological path resolution (os.path.realpath) to neutralize symlink boundary escape attacks; a full guard check (signature, expiry and scope) costs about 8–16 μs for a path that does not exist yet and about 50–60 μs when the path exists and must be resolved (range of four runs of 20,000 calls on the development machine);
4. 100% Prompt Cache Preservation: Capability enforcement executes purely in coroutine ContextVar and physical executor gates, introducing 0 bytes of dynamic pollution into system prompts.

​

3. Empirical Verification & Quality Gates

• Harness Core Tests: unit tests for signing, attenuation, symlink containment and the guard in core/security/test_ocap_mesh.py;
• Spawn Trust Boundary: entry-level tests driven from the delegate_task parameters (test_spawn_trust_boundary.py), and a scripted child run through the real executors (test_spawn_capability_wiring.py) that proves a read-only child cannot write and cannot spawn a writable child.

​

What Gets Stored When You Approve, and What Happens When You Don’t