DeadBolt by NextEleven

DeadBolt

Contributing with an agent? Read AGENTS.md for setup, local checks and project boundaries.

A local execution gate for software agents. Put DeadBolt in the code that runs an action, then let policy and operator controls decide whether that action runs. Embed it in Rust, call its local sidecar from another language, or wrap a trusted stdio MCP server. Free under Apache-2.0.

Install · Try it · Integrate · Migration · Project site

Recent evaluation evidence: ProtocolProbe's read-only setup inspection and NextEleven's separate Swarm native integration lab, with their tested scopes and remaining limits.

Version 2.0.0

This source targets engine 2.0.0 and Python client 2.0.0, with scope frozen at the tested RC3 behavior. Versioned releases identify available downloads, exact source and checksums; installation tracks package-manager, bundle and editor availability separately. A source merge does not publish a package or update a directory listing.

Version 2 requires authenticated operator setup for Unix and TCP sidecars, creates private state, defaults fresh roots to supervisor renewal, and enforces ancestor policy and fixed run deadlines. Existing stored renewal modes remain unchanged. Read major-version migration and private state before replacing an older installation.

The artifact-pinned RC3 retest passed conflicting-destination denial, damaged-store Cursor Reload refusal, and actual model calls after a fixed deadline on macOS arm64. The underlying Auto model was unknown. Separate Linux headless checks cover their recorded scope. These are execution receipts, not certification; stable artifact and installed-consumer checks remain distinct from the RC3 results.

Try it before connecting an agent

No model account, API key, Harness, cloud service or database server is needed. Choose a checksum-verified native archive in the installation guide. From its extracted directory on macOS/Linux:

chmod 0755 deadbolt
./deadbolt --version
./deadbolt drill
python3 examples/evaluate.py --binary ./deadbolt

On Windows, use .\deadbolt.exe --version, .\deadbolt.exe drill and python examples/evaluate.py --binary .\deadbolt.exe. Expected: your selected version, deadbolt drill ok, and JSON with "passed": true. The evaluation starts a private sidecar, writes harmless temporary files, checks that policy, approval, kill and outage block effects, and cleans up afterward. Python 3.9+ is the additional runtime needed. Understand the report.

For a reviewed source checkout, Rust 1.85+ and a native C compiler/linker:

cargo install --path . --locked --bin deadbolt
deadbolt --version
deadbolt drill

The matching Python client 2.0.0 is published. The matching Rust package 2.0.0 is also published. Install the CLI from Cargo, or the Python client in your application environment:

cargo install n11-deadbolt --version 2.0.0 --locked --bin deadbolt
# In your application's virtual environment:
python -m pip install 'n11-deadbolt-client==2.0.0'

For embedded Rust, use deadbolt = { package = "n11-deadbolt", version = "=2.0.0" } and commit your application's own lockfile. The Python wheel contains the client, not the engine. Node remains a bundled source module. Install and verify.

Pick your integration

Your executor	Smallest integration	Start here
Rust application	Embedded store and a check at actual dispatch	Rust
Python application	Local sidecar and dispatch around the actual function	Python
OpenAI Agents SDK function tools	Sidecar and @protected_tool on each protected function	SDK adapter
FastMCP server you own	Sidecar and dispatch_async inside protected tool bodies	Offline recipe
Node or another language	Local sidecar; source Node client or HTTP protocol	Sidecar
Trusted stdio MCP server	deadbolt mcp-proxy … -- SERVER	MCP
Desktop MCP client	Verified local bundle and private operator configuration	Bundle and editor routes
Docker-launched MCP client	Source-built stdio container and trusted downstream	Docker

Choose the exact bundle and matching configuration before installation. Blank configuration exposes two read-only setup tools and provides no active protection. Configured tools come from your trusted downstream server. Version 2 bundle runs require a fixed deadline, deliberate renewal mode and reviewed offline exceptions. The bundle uses broad one-shot tool approvals; it does not provision exact-action grants. Configuration · Editor guide.

Discover versioned bundles through Smithery and the official MCP Registry. Check each entry's version and checksum. Discovery is not hosted operator access, marketplace acceptance of another submission, or an endorsement.

Put the gate at the effect

Your trusted executor creates the run and configures policy first. With the matching Python client installed and its sidecar configured:

from pathlib import Path
from deadbolt_client import dispatch

outcome = dispatch(
    "executor-run-001", "write_file",
    lambda: Path("output.txt").write_text("allowed work"),
)
if not outcome["executed"]:
    print("Action blocked:", outcome["decision"]["code"])

A fresh admission happens before the callback; a denial leaves the body uncalled. Complete setup covers provisioning, policy, credentials, transport and errors. Wrap every protected route. Never cache an allow or split one-shot admission from execution. ensure confirms record presence, not liveness.

Controls and limits

• Tool and destination policies, reported-spend caps, pause, clips and operator kill.
• Default 60-second idle TTL. A separate supervisor maintains fresh runs; explicit activity mode is available. Neither mode can move a fixed deadline or revive expired/killed state. Liveness · Deadlines.
• Descendants obey ancestor restrictions. A child policy cannot widen its parent.
• Broad one-shot tool approvals and exact-action grants for trusted integrations using the content-bound API.
• Scoped admission credentials separate dispatch from operator controls. /spend remains operator-only.
• SQLite evidence, JSONL mirrors and per-agent incident exports.
• Store or transport failure denies protected dispatch; malformed or unsuccessful responses never authorize the body.

Ordinary trusted-executor admission treats unset policy lists as open; the MCP proxy requires explicit tool policy. Configure runs and children before dispatch. MCP discovery can advertise tools that the policy will deny. Destination parsing covers recognized fields, not arbitrary arguments or network traffic. Destination policy.

Know the boundary

DeadBolt protects connected execution routes. It does not sandbox arbitrary code, stop a provider, or make external effects transactional with admission. Kill blocks subsequent admissions; stopping in-flight work requires an executor cancellation pattern. The MCP child remains trusted and has OS access; startup and non-tool methods are outside the tool-call gate.

Keep state and operator authority outside untrusted agent processes. A process able to write the database or invoke the operator CLI has operator authority; socket credentials cannot contain it. Use separate OS/service ownership and OS egress controls where your application requires those boundaries. Evidence hashes identify content; operator-writable records are not tamper-proof certification. Trust · HTTP authentication · Pilot checklist.

Developer documentation

Need	Guide
First working result	Quick start, first evaluation
Binary, crate or Python installation	Installation
Embed, sidecar or MCP wiring	Integration, Python / SDK
Least-authority dispatch and sensitive actions	Credentials, exact approvals
API and upgrade behavior	HTTP protocol, compatibility
Denial or setup problem	Troubleshooting, FAQ
Deploy, backup and respond	Operations, incidents
Evaluate or contribute	Technical brief, Hermes showcase, contributing
Versions and packaging	Changelog, release procedure, third-party notices

Source checks: cargo test --locked, cargo clippy --all-targets --locked -- -D warnings, and python3 tests/client_contract.py after cargo build --locked --bin deadbolt (Python and Node required). CI also checks Rust 1.85, installed Python/SDK behavior and native packages. Passing these checks does not establish acceptance of your application.

Report ordinary bugs or use private security reporting. Copyright NextEleven LLC 2026. License · Notice. Harness is one consumer, not a prerequisite.

For trusted executors that need to stop already running local commands, the owned-process cancellation reference adds a POSIX supervisor pattern with disposable acceptance. It does not change the gate into a sandbox or add enforcement to older packages.