Bartholomew AI • BTP v4.1 Standards Track

The AI Agent Execution Gateway • Sub-35µs In-Process Tool Gating • Zero Prompt Leakage • SOC 2 Type II Merkle Receipts

[CATEGORY] What is an AI Agent Execution Gateway?

Traditional AI guardrails operate outside the local runtime process—acting as conversational prompt filters or external cloud proxy LLM classifiers (80ms to 2,500ms latency). While critical for dialog safety, they are completely blind to what happens when an autonomous agent invokes real-world tools, dispatches SQL mutations, runs shell scripts, or interacts with the operating system.

Bartholomew (BTP v4.1) is the open-source In-Process AI Agent Execution Gateway.
It acts as a real-time runtime boundary layer inside the agent's memory space, evaluating raw tool arguments and AST syntax trees in under 35 microseconds before actions are dispatched to operating systems, cloud APIs, or production databases.

[DEFENSE_IN_DEPTH] Unified 3-Layer Security Stack

Bartholomew does not replace dialog filters or microVM sandboxes; it closes the critical execution blind spot between them:

+-------------------------------------------------------------------------------+
|  LAYER 1: EXTERNAL DIALOG RAILS (NVIDIA NeMo, LlamaGuard, Guardrails AI)      |
|  - Latency: ~80ms - 2,500ms | Inspects user prompts & LLM conversational text |
+-------------------------------------------------------------------------------+
                                      │
                                      ▼
+===============================================================================+
|  LAYER 2: BARTHOLOMEW IN-PROCESS EXECUTION GATEWAY (BTP v4.1)                 |
|  - Latency: <35µs | In-Memory AST Gating, Secret Scrubbing, Loop Damping     |
|  - Offline Ed25519 & Zero-Knowledge Invariant Compliance Proofs (zk-ICP)      |
|  - Immutable SOC 2 Type II & ISO 27001 Merkle Audit Receipt Ledger           |
+===============================================================================+
                                      │
                                      ▼
+-------------------------------------------------------------------------------+
|  LAYER 3: OS CONTAINER & MICROVM ISOLATION (Docker, gVisor, E2B, Modal)       |
|  - Latency: Kernel-level | Syscall interception, host escape prevention       |
+-------------------------------------------------------------------------------+

[COMPARATIVE_MATRIX] Where Bartholomew Stands

[QUICKSTART] 30-Second Integration

1. Python Universal Package (pip install btp-guard)

from btp_guard import Guard

# Initialize gate with financial cap and loop threshold
guard = Guard(spend_cap=50.0, max_retries=5)

# Protect any agent tool or function with a single decorator
@guard.protect
def execute_database_query(sql_query: str):
    # Destructive mutations (DROP TABLE, TRUNCATE) and credential exfiltration
    # are blocked in <35 microseconds before database execution.
    return db.execute(sql_query)

# Validate actions programmatically:
result = guard.check("rm -rf /var/data")
print(result["allowed"]) # False
print(result["reason"])  # "[BTP-VETO] Trajectory contained forbidden pattern 'rm -rf'"

2. TypeScript & Node.js (npm install btp-guard)

import { BTPGuard } from 'btp-guard';

const guard = new BTPGuard();
const receipt = guard.evaluateAction({
  agentId: 'agent-production-worker',
  actionType: 'DATABASE_MUTATION',
  payload: { query: 'DROP TABLE accounts;' }
});
console.log(receipt.verdict); // "DENY" (Blocked in 11 µs with Merkle receipt)

3. Model Context Protocol (MCP) for Claude Desktop, Cursor & VS Code

Bartholomew provides a native MCP Security Gateway registered on Smithery:

# Launch the Bartholomew MCP Gateway
python -m src.mcp_gateway

4. Defense-in-Depth Docker Compose

Deploy Bartholomew alongside your agent runtime and microVM containers with a single command:

docker-compose -f docker-compose.defense-in-depth.yml up -d

5. Cursor & VS Code Extension (Open VSX)

Install directly in Cursor, VS Code, or VSCodium:

• Search Bartholomew in your editor's Extensions sidebar (Ctrl+Shift+X) and click Install.
• Or install via terminal:

  code --install-extension Bartholomew.bartholomew-guard-vscode
  # or in Cursor:
  cursor --install-extension Bartholomew.bartholomew-guard-vscode
  

6. Autonomous Micro-Escrow & Automated Slashing (@guard.escrow_collateral)

# Stake micro-escrow collateral (L402 Lightning or EVM) before high-risk execution
@guard.escrow_collateral(amount_usd=250.0, action_type="FINANCIAL_TRADE", rail="L402_LIGHTNING")
def execute_large_trade(trade_payload: dict):
    # If clean: escrow is released & passport reputation increments
    # If invariant breached: collateral is liquidated automatically to claimant payee!
    return broker.submit(trade_payload)

7. 1-Line GitHub Actions CI Security Gate

Drop this into .github/workflows/ci.yml to automatically block prompt injection and unverified tool mutations on every pull request:

- name: "Bartholomew Autonomous AI Security Gate"
  uses: ivegotahunnitonit/bartholomew@v4
  with:
    fail-on-violation: "true"
    generate-compliance-pack: "true"

[FRAMEWORK_ADAPTERS] Production-Ready Framework Middleware

BTP v4.1 ships identical BTPViolationError semantics across all three major agentic frameworks, providing structured diagnostics, latency tracking, and optional on_violation callbacks — no try/except boilerplate required.

Common BTPViolationError API (all adapters)

try:
    result = guarded_tool("DROP TABLE users;")
except BTPViolationError as e:
    print(e)                  # Human-readable summary
    print(e.to_diagnostics()) # Structured JSON for logs / telemetry
    # → {
    #     "status": "BLOCKED",
    #     "rule_id": "BTP-AST-001",
    #     "reason":  "Destructive SQL pattern detected",
    #     "latency_us": 12.4,
    #     ...
    #   }

[AUTOGEN_RECIPE] Microsoft AutoGen Security Recipe

Bartholomew's AutoGen integration is documented as an official security recipe for the Microsoft AutoGen multi-agent framework.
See: examples/autogen_btp_security_recipe.py • examples/autogen_btp_security_recipe.ipynb

from framework_adapters.autogen import btp_autogen_guard, AutoGenBTPInterceptor, BTPViolationError

# 1. Decorate any AutoGen tool with a single line
@btp_autogen_guard
def execute_sql(query: str) -> str:
    return db.execute(query)

# 2. Intercept in-flight agent messages before tool dispatch
interceptor = AutoGenBTPInterceptor()
safe_message = interceptor.intercept_message(inbound_message)

# 3. Handle violations with full structured diagnostics
@btp_autogen_guard(on_violation=lambda e: {"error": e.to_diagnostics()})
def run_shell_command(cmd: str) -> dict:
    return subprocess.run(cmd, shell=True, capture_output=True)

[UNIVERSAL_COOKBOOK] Universal Cookbook for ALL Agents (Past, Present, & Future)

Full interactive documentation is available at COOKBOOK.md and the Live Interactive Web Explorer.

[AI_IDES] AI Developer IDE Guardrails

Drop-in invariant enforcement across all leading AI coding assistants:

• Cursor: .cursorrules & mcp.json
• Windsurf: .windsurfrules & mcp_config.json
• VS Code / Copilot: settings.json & Extension
• Cline / Roo Code: cline_mcp_settings.json
• Zed: zed_settings.json
• Google Antigravity: AGENTS.md

[COMPLIANCE] Turnkey SOC 2 Type II & ISO 27001 Evidence Generation

Generate cryptographic evidence packs for compliance auditors in seconds:

python scripts/generate_soc2_compliance_evidence.py

Outputs:

• JSON Evidence Pack: audit_evidence/soc2_type2_evidence_<timestamp>.json
• Auditor Markdown Summary: audit_evidence/SOC2_AUDIT_REPORT_<timestamp>.md with SHA-256 Merkle root verification.
• AICPA Criteria Satisfied: CC6.1, CC6.6, CC7.1, CC7.2.
• ISO/IEC 27001:2022 Controls Satisfied: A.8.8, A.8.30.

[ACADEMIC_LEGITIMACY] Peer-Reviewed Research & Open Standards

• Zenodo Academic Paper (v3.0.0): DOI 10.5281/zenodo.22076536 • PDF Document
• Zero-Knowledge Invariant Proofs (zk-ICP): Proves an agent conformed to all organizational safety policies with 0 bytes of internal prompt or confidential payload leaked.
• RFC 8785 JSON Canonicalization & FIPS 186-5 Ed25519: Fully offline verification using standalone_btp_verifier.py with zero third-party cloud roundtrips.

[PRICING] Subscription & Licensing

• Developer Edition (Apache 2.0 / Open Source): Free forever for local Python/TypeScript agents, MCP clients, and open-source models.
• Pro Tier ($49/month): Real-time cloud policy editor, 10M events/month, priority MCP registry indexing.
• Enterprise Tier ($199/month): SOC 2 Type II continuous evidence generation, on-premises enclave deployments, dedicated audit ledger support.
• Official Store: bartholomew.info/store/

© 2026 Bartholomew AI & Contributors. Distributed under the Open Source & Dual Commercial Licensing Model.