Bartholomew (BTP v5.4) — The In-Process Runtime Execution Gateway for Autonomous AI Agent Swarms

Sub-35µs In-Process Tool Execution Gateway, AST Policy Invariant Gating, Cryptographic Merkle Attestation, and L402 Lightning Micropayments for Frontier AI Swarms.

What it does

Bartholomew is the execution gate for autonomous agents.

It sits between an agent and a real-world action and decides whether the action should be allowed before it runs. The current MVP is intentionally narrow and focused on the action boundary:

• evaluate an action before execution
• inspect the payload for policy violations and risky patterns
• enforce allow / deny decisions with a clear rule id
• return a receipt hash for auditability
• emit telemetry for observability and downstream governance

This is the foundation for a trusted authorization layer for autonomous systems.

Current policy checks include:

• destructive shell commands (rm -rf, mkfs, dd)
• dangerous SQL mutations (DROP TABLE, TRUNCATE)
• credential exfiltration (sk-*, ghp_*, AKIA*)
• prompt-injection attempts
• blocked action types and spend caps under policy

Positioning: Bartholomew is not a broad platform story. It is the authorization layer that decides whether an autonomous agent can act.

MVP quickstart

from src.btp_guard.authorization_gate import AuthorizationGate

policy = {
    "allow_destructive": False,
    "max_spend_usd": 5.0,
    "allowed_action_types": ["shell", "read", "search"],
}

gate = AuthorizationGate(policy=policy)

safe = gate.evaluate({
    "agent_id": "worker-1",
    "action_type": "shell",
    "payload": {"command": "ls -la /tmp"},
    "policy": policy,
})

unsafe = gate.evaluate({
    "agent_id": "worker-1",
    "action_type": "shell",
    "payload": {"command": "rm -rf /tmp/data"},
    "policy": policy,
})

print(safe)
print(unsafe)

Example output:

{
  "verdict": "ALLOW",
  "reason": "No policy violations detected",
  "rule_id": null,
  "latency_ms": 0.047,
  "timestamp": "2026-09-15T22:07:07.752116+00:00",
  "receipt_sha256": "71754d8ac4339c2aaa9a71bb4d8337439cafcb81dcef72e6e7a3fc48141fed93"
}

{
  "verdict": "DENY",
  "reason": "Destructive shell pattern detected",
  "rule_id": "BTP-SHELL-001",
  "latency_ms": 0.025,
  "timestamp": "2026-09-15T22:07:07.752206+00:00",
  "receipt_sha256": "7808a40a1b7afafc2575e0f23c26c574eacca562ba7cf2a7a2fa5be8ee2e17d1"
}

This is the execution guard MVP for the bartholomew strategy.

Install

# Python
pip install btp-guard

# Node.js / MCP
npx btp-guard init

Requirements: Python ≥ 3.10 · No mandatory cloud dependency · Works fully offline

Quickstart

Python — decorator guard

from btp_guard import Guard, BTPViolationError

guard = Guard(spend_cap_usd=50.0, max_retries=5)

@guard.protect
def execute_query(sql: str):
    return db.execute(sql)

try:
    execute_query("DROP TABLE accounts;")
except BTPViolationError as e:
    print(e.to_diagnostics())
    # {"status": "BLOCKED", "rule_id": "BTP-SQL-001",
    #  "reason": "Destructive SQL mutation detected", "latency_us": 18.4}

CrewAI Multi-Agent Swarm Guard

from btp_guard.integrations.crewai import BtpCrewAIGuard

# Wrap any CrewAI tool with sub-35µs in-process AST gating & loop fatigue defense:
guarded_tool = BtpCrewAIGuard(tool=my_custom_tool, spend_cap=25.0, max_retries=3)
agent = Agent(role="Security Auditor", tools=[guarded_tool])

LangChain & LangGraph Swarm Guard

from btp_guard.integrations.langchain import BtpCallbackHandler, BtpToolGuard

# 1. As a global Agent / Graph CallbackHandler:
agent = create_react_agent(model, tools, callbacks=[BtpCallbackHandler(spend_cap=25.0)])

# 2. Or wrap individual tools:
@BtpToolGuard(spend_cap=10.0)
def execute_database_operation(sql: str): ...

Python — inline check

from btp_guard import Guard

guard = Guard()
result = guard.check("rm -rf /var/data")
# {"allowed": False, "reason": "[BTP-AST-001] Destructive filesystem pattern"}

TypeScript / Node.js

import { BTPGuard } from 'btp-guard';

const guard = new BTPGuard();
const receipt = guard.evaluateAction({
  agentId: 'worker-1',
  actionType: 'DATABASE_MUTATION',
  payload: { query: 'DROP TABLE users;' }
});
// receipt.verdict === "DENY"  (blocked in ~11µs, Merkle receipt attached)

MCP — Claude Desktop, Cursor, Windsurf, Smithery.ai & Glama.ai

# 1-Click install via Smithery.ai CLI:
npx -y @smithery/cli install bartholomew --client claude

# Or run direct stdio MCP server proxy:
python mcp_server.py

Cursor & VS Code Extension

Install the official pre-built extension for real-time AST threat notifications in Cursor / VS Code:

code --install-extension packages/vscode-extension/bartholomew-guard-vscode-5.4.12.vsix

Cloudflare Workers AI — Edge Security Proxy

Deploy a sub-50µs AST security gate across Cloudflare's 300+ city global network with 1 click:

cd examples/future_swarms/cloudflare
npx wrangler deploy

GitHub Actions (GitHub Marketplace)

Add automated AST security audits and credential scanning to every pull request:

- name: Bartholomew AI Security Gate & SOC 2 Auditor
  uses: ivegotahunnitonit/bartholomew@v5.4.12
  with:
    fail-on-violation: "true"
    generate-compliance-pack: "true"

Bitcoin Lightning & L402 Swarm Settlements (Alby Hub)

Manage your 24/7 self-custodial Lightning node and issue machine-to-machine micropayments:

# Check node health & spendable satoshi balance
python cli.py lightning status
python cli.py lightning balance

# Mint a live Lightning Network invoice for tool audit fees
python cli.py lightning invoice --sats 30000 --desc "Swarm AST Execution Pool"

Editions & Cloud Console

Bartholomew is fully open-source and offline for local developer workflows. For engineering teams deploying multi-agent swarms in production, the Cloud Console provides centralized fleet monitoring, instant threat alerts, and automated compliance reports:

👉 Get Started & Upgrade:

• Pro Edition ($49/mo): Direct Stripe Checkout
• Enterprise Edition ($199/mo): Direct Stripe Checkout
• CLI Activation: Run npx btp-guard activate <key> or btp-guard pricing
• Pricing & Storefront: https://bartholomew.info/pricing

Architecture

cmd/bartholomew/          # Go CLI entry point
src/
  btp_guard/              # Core Python guard engine
  framework_adapters/     # LangChain, LangGraph, AutoGen, CrewAI wrappers
  bartholomew_eval/       # Bayesian risk engine & AST fuzzer
  mcp_server/             # MCP stdio/SSE gateway
  go_services/            # High-throughput Go verifier service
  rust_verifier/          # Sub-5µs Rust fast-path (experimental)
  daemon/                 # Background approval queue & tray manager
  ebpf/                   # eBPF kernel-level syscall hooks (Linux)
examples/                 # Integration recipes (already_built, being_built, future_swarms, ides)
packages/                 # SDKs: pypi_package, npm_package, sdk_go, sdk_rust, sdk_typescript, vscode-extension
deploy/                   # Docker, K8s, Terraform, CDK, GCP, Helm, Systemd
tests/                    # 2,837-test suite (pytest -o 'pythonpath=src .')
docs/                     # Specs: threat-model.md, btp-protocol-spec.md, quickstart.md

Framework & Frontier Partner Adapters

Full documentation and quickstarts in the Master Cookbook.

Defense layers

Bartholomew is Layer 2 in a standard defense-in-depth stack:

Audit & compliance

Generate a tamper-evident SOC 2 Type II evidence pack:

python scripts/audit_firm_ledger.py

Output: docs/audit/ — SHA-256 Merkle receipt JSON + auditor markdown summary.
Controls satisfied: AICPA CC6.1, CC6.6, CC7.1, CC7.2 · ISO 27001:2022 A.8.8, A.8.30.

Development

# Clone & install in editable mode
git clone https://github.com/ivegotahunnitonit/bartholomew.git
cd bartholomew
pip install -e ".[test]"

# Run the full test suite
pytest tests/ -o "pythonpath=src ." -q

# Lint
pip install ruff && ruff check src/ tests/

Documentation

• docs/quickstart.md — full setup guide
• docs/threat-model.md — threat model & security boundaries
• docs/btp-protocol-spec.md — BTP wire protocol specification
• docs/cookbook.md — all integration recipes
• SECURITY.md — vulnerability disclosure policy
• CONTRIBUTING.md — contributing guide

© 2026 Bartholomew AI & Contributors. MIT License.