Enforce
Runtime Security
Cirvix sits between the agent and the tool. Every call is parsed, normalized, and checked against the policy set before any side effect occurs. The agent receives a structured refusal it can reason about, not a crash.
The problem
An agent that can call tools can be induced to call them by anyone whose text reaches its context — a README, a ticket comment, a web page, a PDF. The model cannot reliably distinguish instructions from data, so the boundary has to exist outside the model.
Capabilities
How Runtime Security works
- 01
Argument-level inspection
Calls are decoded into a canonical form before evaluation, so a path traversal, an encoded payload, and a symlink that resolves outside the workspace are all the same object to policy.
- 02
Deterministic refusal
A blocked call returns a typed error naming the policy that denied it. Agents recover and re-plan instead of retrying blindly or hanging.
- 03
Injection heuristics as signal, not gate
Content classifiers score tool results for instruction-like text and attach the score to the trace. Scores can raise an approval requirement; they never silently permit.
- 04
Egress control
Outbound destinations are matched against an allowlist at resolved-IP level, so a hostname that resolves into link-local or internal ranges fails closed.
In practice
What it looks like
{ "error": "cirvix.policy.denied", "decision_id": "dec_01JQ8F2K7M", "reason": "Reading .env* is denied outside an approved secrets flow.", "policy": "deny-dotenv-read", "resource": "fs://repo/.env.production", "remediation": "Request the value as a secret handle: secrets.get(\"STRIPE_KEY\")", "appealable": true}Limits
What this does not do
- Cirvix authorizes actions, it does not make a model trustworthy. A compromised agent still produces compromised reasoning — what changes is the set of actions that reasoning can reach.
- Injection detection on natural-language content is probabilistic. It is used to raise friction, never as the sole control protecting a sensitive resource.
- Calls that bypass an instrumented surface entirely — a subprocess the agent spawns outside a wrapped runtime — are outside enforcement until that surface is instrumented too.
Get started
Let the agents do real work.
Start with the free local scanner — it needs no account and tells you what is already ungoverned on your machine. Move to a governed runtime when you are ready.
Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.