What Cirvix does and does not defend against
A control plane that claims no limits either hasn't shipped or isn't being described honestly. This page states the boundary plainly.
Defends against, according to configured policy
- A tool call a policy denies, before it executes
- A secret placed directly in the model's context — the agent only ever holds a handle
- Scope growth across a chain of delegated agent calls
- An MCP tool whose definition changed silently after approval
- An outbound request to a destination outside the configured allowlist, checked at resolved-IP level
Does not defend against
- A policy you wrote that is itself too permissive
- A model's reasoning being wrong, when that reasoning never produces a call Cirvix sees
- Compromise of the host underneath the broker
- A credential Cirvix was never told about
- An agent calling a tool through a surface that isn't instrumented
Warning
Injection detection on tool-result content is probabilistic signal, not a gate — it can raise the friction on a call (require an approval, for instance), but it never silently permits, and it is never the only control protecting a sensitive resource. Enforcement is described as acting "according to configured runtime policies"; nothing on this site claims to prevent all prompt injection, because that claim wouldn't be true of any system.
Edit this page on GitHub
Was this page helpful?