sint-ai/sint-protocol

**Open-source runtime security and governance for AI agents, MCP tools, robotics, industrial automation, and physical AI.**
**Mission Authority:** SINT also provides a hardware-agnostic authority and
evidence protocol for autonomous air, ground, maritime, and robotic systems. It
binds platform identity, mission scope, operator authorization, abort behavior,
and signed after-action evidence without selecting targets or generating
effects. See docs/mission-authority.md.
SINT Protocol is an open protocol and TypeScript reference stack that sits
between AI agent intent and real-world execution. Before a governed tool call,
robot command, industrial write, payment-like action, or actuator movement can
run, the request passes through PolicyGateway.intercept() for capability-token
authorization, T0-T3 approval tiering, physical constraint enforcement,
revocation checks, and tamper-evident evidence logging.
What is SINT Protocol?
SINT is an AI agent security control plane for actions with real-world
consequence. It helps teams answer four questions before an autonomous system
acts:
- **Who is allowed to act?** Ed25519 capability tokens bind issuer, subject,
resource, action, expiry, constraints, and delegation chain.
- **What constraints apply?** Velocity, force, geofence, budget, rate-limit, and
consent constraints travel with the token instead of living in ad hoc config.
- **When is human review required?** T0-T3 approval tiers route low-risk actions
automatically and escalate physical or irreversible actions to operators.
- **How do you prove what happened?** Every decision can be written to a
SHA-256 hash-chained EvidenceLedger with portable proof receipts.
Where SINT Fits
SINT is not a replacement for MCP, A2A, ROS 2, MAVLink, MQTT, OPC UA, Open-RMF,
or industrial robot tooling. It is the enforcement layer in front of those
systems:
- **MCP security:** authorize tool calls before an MCP server executes them.
- **Agent runtime governance:** add pre-tool authorization, typed deny/escalate
outcomes, and evidence references to agent frameworks.
- **Robotics and drones:** enforce ROS 2, MAVLink, PX4, and fleet actions with
physical constraints and e-stop semantics.
- **Industrial automation:** govern OPC UA, MQTT/Sparkplug, SRCI, simulator, and
offline robot-program paths before PLC or robot actions touch equipment.
- **Consumer and regulated data:** apply consent, caregiver delegation,
differential privacy, and audit exports for smart-home and health workflows.
Latest Implementation Highlights
- **Installable MCP proxy:** npx -y sint-mcp --stdio runs the security-first
multi-MCP proxy.
- **Industrial humanoid shipyard safety:** executable conformance fixtures now
cover Persona-style shipyard humanoid welding, hot-work permits, fire watch,
fume extraction, confined-space gas safety, bystander escalation,
simulation-to-execution drift, material load envelopes, and unconditional
e-stop rollback.
- **Shipyard bridge and evidence scaffolding:** ROS 2 weld-start profile
helpers, OPC UA safety-signal mappings, Isaac Sim receipt stubs, and
sintctl shipyard evidence export generate hash-chained JSONL evidence for
supervisor review, remote survey support, and incident reconstruction.
- **Agent commerce governance:** the Economic Layer now includes a conformance
profile for agent-to-agent task markets: task creation, bids, worker
selection, benchmark-proof submission, settlement release, and x402-style
payment permits.
- **Five-minute interceptor demo:** pnpm run demo:interceptor-quickstart
shows request -> decision -> receipt and the fail-closed path.
- **Production gateway posture:** production mode requires durable stores,
explicit authentication, readiness checks, and signature enforcement.
- **Industrial action pack:** pnpm run demo:factory-action and
pnpm run demo:industrial-pack verify deny, escalate, approve, simulate, and
receipt-chain flows before vendor adapter execution.
- **Autonomy supervisor:** @pshkv/autonomy-supervisor adds an authority lane
for managed autonomy: stable -> metacognitive_recovery ->
assisted_recovery -> regulated_control.
- **External evidence packets:** OWASP Agentic AI landscape, MITRE ATLAS
candidate mappings, AAIF RFC-001 packet, NIST bundle, dependency review, and
production-slice validation artifacts are published under docs/.
- **Open physical-envelope research:** the
SINT × DriftCore collaboration roadmap
proposes protocol-neutral attestation schemas, adversarial fixtures, and