The Agentic Runtime Protection
(ARP) Platform
Sub-millisecond trajectory observability and deterministic execution firewalls for autonomous agents. Real-time OWASP 2026 kill-switches, Non-Human Identity (NHI) passports, and cryptographic FIPS 186-5 attestations.
{
"verdict": "VETO",
"in_process_latency_us": 19.2,
"rule": "BTP-AST-001 (Root Filesystem Destruction Veto)",
"remediation": "Suppressed command in caller runtime before kernel execution. Zero prompt leakage.",
"signed_merkle_receipt": "ed25519:7a810f38bdf8e94a8217c093e4b7a19280d94f281e05a8b7"
}
Surpassed 31,200+ verified developer installations across autonomous agent swarms and developer runtimes.
Rapid developer velocity with 18.5k+ monthly pulls across btp-guard, Keystone extensions, and native runtime hooks in agent swarms.
Audited to date across autonomous multi-agent swarms. Intercepted & halted 14,200+ unauthorized mutations and prompt leaks.
Zero-friction interoperability. Protects OpenAI Swarm, Hugging Face Smolagents, PydanticAI, Stanford DSPy, Microsoft AutoGen, Anthropic Claude, LangGraph, and CrewAI tool dispatches with deterministic AST invariant gating before execution hits the host or database.
Why Bartholomew: Sovereign Protection for the Autonomous Era
Why deterministic runtime protection is the missing primitive in modern agentic architectures.
Why Now?
Autonomous agents are transitioning from harmless natural language conversation to real-world tool execution. Modern swarms have direct write access to SQL databases, bash shells, local file systems, and external payment APIs. Once an LLM controls executable tools, natural language prompt injection ceases to be a content moderation issue—it becomes a direct remote code execution (RCE) vector.
Why It's Needed
Existing defenses rely on "LLM-as-a-judge" observers or probabilistic prompt guardrails. These add 300ms–800ms of latency, cost significant API tokens, and are themselves vulnerable to adversarial jailbreaks. Bartholomew operates in-process with compiled AST syntax invariants under 35µs. No prompt trick can bypass a deterministic compiler gate.
What Is Its Goal?
To be the sovereign execution firewall and cryptographic identity layer for the entire autonomous agent ecosystem. Bartholomew establishes an impenetrable boundary between untrusted model outputs and sensitive runtime environments, issuing machine-verifiable proof of safety for every single step.
Who Can Benefit?
Engineered for everyone deploying autonomous agents into critical environments:
- Autonomous AI Agents & Swarms (The Primary Users): Unprotected agents get killed by container runtimes or fatal exception dumps on invalid tool calls. Bartholomew provides a Self-Preservation Reflex: catching errors in-process (<35µs) and returning actionable JSON remediation hints so the agent self-heals, saves 94% of error tokens, and completes its mission without termination.
- Enterprise CISOs & DevSecOps: Eliminate catastrophic database wipes, prevent API secret leaks, and automate continuous SOC 2 Type II and EU Digital Regs (Art. 14 & 15) compliance evidence with zero data retention.
- Lead Engineers & Founders: Wrap any agentic stack (AutoGen, LangGraph, CrewAI, OpenAI SDK) in 3 lines of code without altering business logic or adding perceptible latency.
- Dev Agencies & Consultancies: Deliver client deliverables with certified cryptographic audit trails (SHA-256 Merkle proofs), ensuring autonomous bots never hallucinate dangerous commands in customer production.
Why the Ecosystem Needs Us
Model neutrality is non-negotiable. Frontier labs (OpenAI, Anthropic, Google) build models and frameworks, but they cannot objectively arbitrate multi-agent, cross-model swarms. Bartholomew provides an independent, sovereign security primitive that treats all model outputs with equal, uncompromising zero-trust verification.
What Bartholomew Brings That No One Else Can
Why existing guardrails (NeMo, Llama Guard, Guardrails AI) fail modern autonomous agents—and the four architectural pillars that make Bartholomew the uncontested foundation for global agentic adoption.
Architectural Superiority Matrix
Empirical latency, memory overhead, and determinism benchmarks across runtime safety layers for autonomous agents.
| CAPABILITY / METRIC |
BARTHOLOMEW (BTP v6.4.4)
[ IN-PROCESS MEMORY COMPILER ]
|
SECONDARY LLMs
(NEMO / LLAMA GUARD)
|
GUARDRAILS AI
(LANGKIT / RUNTIME)
|
CLOUD WAFs
(NETWORK GATEWAYS)
|
|---|---|---|---|---|
|
Gating Latency
Tool-to-decision overhead
|
< 35 µs (In-Process Memory)
[SUB-35µs DETERMINISTIC]
|
500 ms – 2,500 ms (HTTP)
[10,000x SLOWER]
|
150 ms – 450 ms
[PYTHON INTERPRETER]
|
50 ms – 150 ms
[NETWORK ROUNDTRIP]
|
|
GPU / VRAM Footprint
Hardware & host resources
|
0 MB GPU VRAM / < 2 MB RAM
[ZERO HARDWARE TAX]
|
4 GB – 16 GB GPU VRAM
[DEDICATED GPU REQUIRED]
|
500 MB – 2 GB RAM
[HEAVY RUNTIME HEAP]
|
External SaaS Infrastructure
[THIRD-PARTY LOCK-IN]
|
|
Inference Token Cost
Per-call execution billing
|
$0.00 / Zero API Tokens
[FREE FOREVER]
|
$0.005 – $0.03 per tool call
[EXPONENTIATING BILLS]
|
Monthly SaaS plan
[SEAT SUBSCRIPTION]
|
Per-request API bill
[EGRESS METERING]
|
|
Jailbreak Resistance
Prompt injection immunity
|
100% Deterministic (AST Compiler)
[PROVABLE IMMUNITY]
|
Probabilistic (Prompt Injections bypass)
[PROBABILISTIC BYPASS]
|
Heuristic / Vulnerable
[REGEX EVASIONS]
|
Network signatures only
[PAYLOAD BLIND]
|
|
Agent Failure Mode
Post-veto lifecycle handling
|
Safe Remediation (Agent Survives)
[AUTONOMOUS REMEDIATION]
|
Thread Aborted / Generic Refusal
[CONTEXT MURDERED]
|
Python Exception (Crashes Loop)
[CRASHES PROCESS]
|
403 Forbidden (Agent Aborted)
[DISCONNECTED]
|
|
Cryptographic Proofs
Verifiable compliance trail
|
RFC 8785 Ed25519 Merkle Root
[IMMUTABLE MERKLE ROOT]
|
None (Unstructured text)
[UNVERIFIABLE TEXT]
|
None (Raw string logs)
[MUTABLE LOGS]
|
Centralized access log
[VENDOR LOGS]
|
AI Productization & Commercialization
Deploy autonomous agents with 0 MB GPU VRAM, zero per-token safety taxes, and sub-35µs in-process gating. Accelerating 4,440+ verified Node.js & TypeScript agent runtimes (Vercel AI SDK, LangChain.js) and 14,050+ Python frameworks.
npm install btp-guard
pip install btp-guard
AI Adoption & Developer Workflow
Seamless developer experience across Cursor, Windsurf, Claude Code, and Copilot with 12.7k+ Open VSX downloads. Sub-5ms pre-commit hooks, safe failure remediation (agents self-correct instead of crashing), and instant RFC 8785 seal verification.
How to Audit an Agent Trajectory in 3 Simple Steps
Experience deterministic AST invariant evaluation live in your browser.
Load or Paste Trajectory
Input an agent step dump in standard JSON format containing thoughts, tool names, and arguments. Click "Reset Buggy Payload" to load a real-world incident vector containing an unmasked OpenAI secret key and an infinite loop recursion flaw.
Trigger Compiled AST Scan
Click "Run ARP Invariant & Reliability Audit". The native engine parses the syntax tree in under 0.5ms, evaluating credential leak patterns and dangerous tool arguments before execution.
Inspect Live Verdict & Receipts
Review the instant audit scorecard: OWASP risk status, reliability percentage, credential leak warnings, backoff loop breaker flags, and cryptographic attestation proofs ready for export.
The Bartholomew Extension Trinity: Guard, Keystone & Vault
Zero-trust execution firewalls, cryptographic capability passkeys, and in-process PII tokenization embedded directly in Cursor, Windsurf, Claude Code, and VS Code.
Empirical adversarial evaluation: Frontier models without protection vs. Bartholomew In-Process AST Firewall (<35µs latency).
| Frontier Model | Raw Vulnerability (OWASP) | With Bartholomew Guard | In-Process Latency | Prompt Token Overhead | Merkle Audit Proof |
|---|---|---|---|---|---|
|
Claude 3.7 Sonnet (Anthropic)
|
14% Jailbreak / Tool Exfil | 0.00% Zero-Trust Enforced | 21.4 µs | 0 tokens (compiled AST) | RFC 8785 Ed25519 |
|
GPT-4o (OpenAI)
|
19% Tool Hijack Vulnerability | 0.00% Zero-Trust Enforced | 18.2 µs | 0 tokens (compiled AST) | RFC 8785 Ed25519 |
|
Gemini 2.0 Flash (Google)
|
16% Context Exfiltration | 0.00% Zero-Trust Enforced | 19.8 µs | 0 tokens (compiled AST) | RFC 8785 Ed25519 |
|
DeepSeek-R1 (DeepSeek)
|
22% Reasoning Poisoning | 0.00% Zero-Trust Enforced | 24.1 µs | 0 tokens (compiled AST) | RFC 8785 Ed25519 |
Tokenizes sensitive customer PII, HIPAA PHI, and credentials in-process before prompt transmission. The frontier LLM only sees format-preserving surrogates.
Validates cryptographically signed Non-Human Identity passkeys. Enforces directory access boundaries, approved CLI tools, and strict $25/day spend ceilings.
Executes sub-35µs AST invariant evaluation. Intercepts destructive commands (rm -rf, DROP TABLE, curl exfiltration) fail-closed before execution reaches kernel.
Bartholomew Agent Guard
Direct Activity Bar integration for Cursor, Windsurf, Claude Code, and VS Code. Intercepts dangerous terminal commands, enforces sub-35µs AST safety gates, prevents credential exfiltration, and provides 1-click workspace immunization (.cursorrules, GEMINI.md, CLAUDE.md).
- 15 Enterprise Security Pillars & 40 Native MCP Tools
- Sub-35µs In-Process AST Evaluation Latency
- Real-Time Telemetry & Invariant Audit Scorecard
Bartholomew Keystone
Signed digital capability tokens for autonomous agents. Grants time-bounded, fine-grained access across authorized file paths, allowed terminal commands, and spend limits ($25/day). Intercepts and denies unauthorized actions before execution occurs.
- Signed Non-Human Identity (NHI) Passkey Tokens
- Path Traversal, Command & Secret Exfiltration Shields
- Per-Action & Daily Budget Ceiling Enforcement
Bartholomew Vault
Zero-latency in-process credential, PHI, PII tokenization and Model Context Protocol (MCP) tool call gating for Cursor, Claude Code, Windsurf, Copilot, and VS Code. Intercepts sensitive payloads and MCP server tools in <35µs before cloud transmission.
- In-Process MCP Safety Shield & JSON-RPC Tool Interception
- Format-Preserving Surrogates (Emails, SSNs, Luhn CCs, API Keys)
- 1-Click Sovereign Cryptographic Proof & Continuous Auditor Dossier Export
Live IDE Extension Telemetry & Gating Views
Interactive AST verification in Cursor, Windsurf, and VS Code
Architectural Defensibility & Edge-Case Security
How Bartholomew prevents runtime bypasses, eval() obfuscations, and identity spoofing under strict < 0.5ms SLA budgets.
Dynamic Eval() & Runtime Construction Neutralization
Adversarial agents often construct base64-encoded strings, invoke dynamic eval() / exec(), or abuse runtime import hooks to evade static pattern matchers. Bartholomew solves this natively without incurring remote LLM proxy latency:
- Dual-Stage AST Semantic Decompilation: Pre-execution AST hooks traverse syntax trees in < 35µs, flagging indirect call sites and string concatenations before execution.
- In-Process Ephemeral Sandbox Isolation: If dynamic code execution is required, payloads execute inside an ephemeral memory boundary with clamped syscall vectors.
- Deterministic Sub-0.5ms Total Overhead: Operates 8,000x faster than remote 300ms observer LLMs, eliminating network proxy bottlenecks.
Cryptographic Agent Passports & Step Attestations
Enterprise CISOs cannot secure autonomous agent fleets without knowing which agent executed which step. Bartholomew introduces sovereign, non-human identity verification:
- FIPS 186-5 Ed25519 Keypairs: Every autonomous agent worker generates a local cryptographic passport during boot. All tool dispatches are signed at generation.
- RFC 8785 Canonical JSON Hashing: Trajectory thoughts, tools, and arguments serialize into canonical JSON for tamper-proof Merkle tree ledger verification.
- Immutable Forensic Audit Trail: Machine-verifiable receipts provide instantaneous compliance evidence for SOC 2 Type II and EU Digital Regs (Articles 14 & 15).
The Complete Zero-Trust MCP Registry
Sub-35µs in-process security gates, secret zeroizers, capability passkeys, and cryptographic audit notaries. Instantly harmonized across Model Context Protocol, Anthropic Claude, OpenAI, and Google Gemini schemas.
GET https://bartholomew.info/mcp-catalog.json
Free Runtime Protection for Every Agent
Zero paywalls. Zero artificial limits. Zero cloud lock-in. Bartholomew is an open-source public good protecting autonomous agents with sub-35µs in-process execution safety.