Yes: it is a Rust library and executable with bundled SQLite. It does not import Harness or Witness and needs no LLM provider or API key. Optional Witness output is implemented locally. Harness is a consumer, not a prerequisite.
Any language can use the local HTTP protocol. Rust can embed the library. Trusted stdio MCP servers can run behind the proxy. You still need an adapter at the executor's real dispatch boundary. A project that lets agent code invoke tools directly cannot be protected merely by installing a client module.
Kill makes later admissions deny for that ID and its registered descendants. It does not cancel a tool already running, stop a model, discover other agents, or revoke an unrelated agent. Your executor can add cancellation separately.
It can if your integration permits it. The trusted executor must assign stable run identities and bind calls to them. The HTTP token authenticates access to the sidecar, not the agent identity. Anyone with that token can assert any ID and use all exposed routes, including policy changes.
They return decisions; your dispatcher enforces them. Deadbolt is not an OS sandbox. Protect the operator CLI, credentials and state from model-controlled code, and ensure every tool and spawn path uses the dispatcher.
Routed tools/call messages. Individual JSON-RPC 2.0 objects are supported;
batches and malformed envelopes are rejected. Remote HTTP/SSE is not supported.
Initialization, resource reads, other methods and child startup are outside the
gate. The child inherits OS access and environment; it must be trusted.
Unset allow-lists are open. Set tools, destination, irreversible classifications and spend limits before dispatch. Omitted policy fields retain stored values; they do not reset previous policy. An empty allow-list permits no matching tools or hosts. Defaults are not a complete application-specific policy.
Not by itself. Destination metadata is provided by the caller. A missing host
is denied for recognized network classes (http, fetch, browser,
web_search), not a local shell or write_file. Custom network tools need a
trusted adapter with an explicit destination; this is not packet inspection.
No. The trusted caller reports spend. The MCP adapter discovers numeric
amount, usd or cost arguments by convention. A reported spend crossing
the cap pauses the lease; the next admission returns spend_cap. It does not
independently read a provider's bill.
The default lease TTL is 60 seconds. Live admissions, including policy denials,
renew it. Silence past the TTL expires it; killed and expired leases do not
slide. Use a new run ID after expiry. Configure a suitable TTL in the embedded
DeadboltConfig/open_at API; the standalone CLI does not expose a TTL flag.
Kill is terminal for an ID and resume cannot undo it. Resume clears pause and clips and renews the TTL for a non-killed lease, including an expired one; it does not replace policy. That renewal is an explicit operator action, not an automatic client recovery. Use a new executor-assigned ID for a distinct new run. Do not silently allocate a new ID to evade a denial.
No. One approval permits one admission of the specified irreversible tool. Concurrent connections cannot consume the same approval twice. Admission uses it even if the subsequent body or evidence write fails; approve again only after operator review. Other policy checks still apply.
In RC2, every ancestor’s current tool, destination, clip and review restrictions form a ceiling, and its spending cap includes its registered subtree. A child can narrow that ceiling, not widen it. Policy and grants are not copied; approvals bind the actual child. Each MCP child still needs its own explicit tool allowlist. Published 2.0.0-rc.1 and 1.x do not supply these ceilings. Register the child before starting its runner, require a live registration, and configure its actual routes. Registration preserves an existing same-parent child and refuses reparenting/self-parenting. An inactive parent cannot create new live children. Parent kill revokes descendants; the executor owns cancellation of any work already running.
Default behavior is deny store_unavailable. The Python/Node clients also deny
on timeout, malformed responses or non-2xx HTTP status. Never turn that denial
into a fallback that runs the tool. Embedded consumers can explicitly disable
fail-closed behavior; enforce the intended configuration in the trusted executor.
Yes, on the local SQLite store: mutations and approval consumption use immediate transactions, and evidence sequence allocation is shared through SQLite. This is not a distributed service, cluster consensus or a network filesystem design. Validate your own workload; no throughput or latency benchmark is claimed. Connections use a five-second SQLite busy timeout. Slow storage or contention can still deny availability. Prefer a long-lived sidecar or cloned Rust gate, and see concurrent-writer troubleshooting.
No. They contain structured observed/inferred facts and content hashes, and can be exported per agent. An operator with filesystem access can alter them. SQLite and JSONL are separate writes, so a crash can leave them out of sync. Retention, access controls, legal review and incident delivery remain yours.
The repository is Apache-2.0; follow its license and NOTICE obligations. It does not include or relicense Harness. See LICENSE and NOTICE. No certification or jurisdictional compliance is claimed.
Use a published native archive or reviewed source/Git installation. The candidate Python client can be installed from local source or a built wheel; the Node client is bundled source. The Rust and Python package names returned registry 404s on 2026-10-10. Follow installation rather than registry commands. Use GitHub issues for ordinary bugs and integration requests. Report security issues privately as described in SECURITY.md. There is no published support SLA or universal framework compatibility guarantee.