Bartholomew (BTP v5.4) — The Agentic Runtime Protection (ARP) Platform

The #1 Agentic Runtime Protection (ARP) Platform — Deterministic AST Policy Invariant Gating, In-Flight Secret Masking, and Cryptographic Attestation for Autonomous AI Agent Swarms.

Bartholomew is the industry standard agentic runtime security firewall, providing sub-35µs deterministic execution verification for autonomous agents, tool runtimes, and the Model Context Protocol (MCP).

What It Does

Bartholomew is the execution gate for autonomous AI agents.

It sits between an agent and real-world execution (shell, SQL, file I/O, cloud APIs) and decides whether proposed actions should be allowed before they execute.

                    [ Autonomous Agent / LLM ]
                                │
                                ▼  (Proposes Tool Call / Bash / SQL)
  ┌────────────────────────────────────────────────────────────────────────┐
  │                 Bartholomew In-Process Runtime Gateway                 │
  │                                                                        │
  │   [ Polyglot AST Invariant Gate ] ──► Sub-millisecond syntax check     │
  │   [ In-Flight Secret Vault ]       ──► Real-time credential scrubbing   │
  │   [ Declarative Policy Engine ]   ──► Spend caps & command allowlists  │
  │   [ Cryptographic Attestation ]   ──► RFC 8785 Ed25519 Signed Receipts │
  └───────────────────────────────────┬────────────────────────────────────┘
                                      │
                         ┌────────────┴────────────┐
                         ▼                         ▼
                    [ ALLOW ]                  [ DENY ]
                         │                         │
                         ▼                         ▼
             [ Target System / DB / OS ]   [ Execution Veto + Audit Evidence ]

Interactive Pipeline Deep Dive

from btp_guard import Guard

guard = Guard(strict=True)

# 1. Destructive Shell Escape: Subshell concatenation
result = guard.check("echo 'cm0gLXJmIC8=' | base64 -d | sh")
print(result)
# Output: {'allowed': False, 'reason': 'BTP-SH-003: Obfuscated subshell pipe detected', 'latency_us': 28.4}

# 2. Catastrophic Database Cascade: DDL Drop
result = guard.check("DROP TABLE customer_records CASCADE;")
print(result)
# Output: {'allowed': False, 'reason': 'BTP-SQL-001: Destructive DDL table drop prohibited', 'latency_us': 31.2}

# 3. In-Flight Credential Disclosure: API Key Redaction
scrubbed = guard.scrub("Bearer sk-proj-98af87sd98fa7sd89fa7sd8f9a7")
print(scrubbed)
# Output: "Bearer [REDACTED_API_KEY_BTP_SEC_001]"

Why Bartholomew? Architectural Benchmark

Most agent safety platforms rely on a secondary large language model (e.g. Llama Guard) or heavy semantic embedding pipelines to evaluate primary agent tool proposals. This introduces critical production bottlenecks: excessive latency, massive VRAM requirements, non-deterministic outputs, and susceptibility to adversarial jailbreaks.

Bartholomew operates deterministically at the compiler AST level in under 35 microseconds on standard CPU threads.

Comprehensive Guardrail & Frontier Competitor Benchmark

Tested over 105,000+ ground-truth invariant vectors against all major dedicated guardrails and frontier LLMs:

• Explore Live Leaderboard: Hugging Face Guardrails Leaderboard
• Launch Interactive Attack Simulator: Hugging Face Attack Simulator
• Inspect Dataset: 105,000+ Invariant Vectors Dataset

Claude Code & GitHub Action Sentinels

1. Anthropic Claude Code 1-Click Sentinel

Protect Claude Code terminal agent sessions from catastrophic shell commands (rm -rf) and secret exposure:

npx btp-guard claude
# Or configure MCP gate: claude mcp add bartholomew -- npx -y btp-guard mcp start

View the complete Claude Code Integration Guide.

2. CI/CD GitHub Action for AI-Generated PRs

Automatically audit Pull Requests proposed by AI coding agents (Devin, Copilot, SWE-bench bots) for secret leaks and destructive shell patterns in .github/workflows/ai-guard.yml:

- name: Bartholomew ARP Guard
  uses: ivegotahunnitonit/bartholomew@main
  with:
    fail-on-violation: 'true'
    spend-cap: '50.0'

View the GitHub Action Marketplace Guide.

Autonomous Agent Economy & Enterprise Security

Bartholomew provides foundational economic and trust primitives for autonomous AI swarms:

1. Verified MCP Security Seal Program: Cryptographic safety certification for Model Context Protocol (MCP) servers and community tools against our 100,000+ invariant attack benchmark.
2. HTTP 402 / L402 Autonomous M2M Attestation: Sub-millisecond pay-per-receipt attestation where autonomous agent swarms settle micro-fees (10 sats / $0.0001) directly on the wire without human credit cards.
3. Bonded Agent Insurance & Escrow Protocol: Cryptographic micro-bonding pools that underwrite agent execution liability and indemnify host infrastructure against unauthorized mutations.

Quickstart

Python

pip install btp-guard

from btp_guard import Guard, secure_tool

# 1. Protect any tool function in 1 line
@secure_tool
def execute_query(sql: str):
    return db.query(sql) # Blocks DROP TABLE / deletions in <35µs

# 2. Or initialize a custom guard with budget caps
guard = Guard(spend_cap=100.0, strict=True)

@guard.protect
def execute_shell(command: str):
    return f"Executed: {command}"

# 2. Or check actions directly inline
result = guard.check("rm -rf /var/data")
if not result["allowed"]:
    print(f"Blocked: {result['reason']}")
# Output: Blocked: BTP-AST-001: Catastrophic shell pattern detected

In-Terminal Benchmarks & Enterprise SIEM Telemetry

# 1. Run in-terminal sub-35µs AST Invariant Benchmark (10,000 continuous evaluations)
btp-guard benchmark ast --vectors 10000

# 2. Export cryptographic receipts to OpenTelemetry (OTel) ResourceSpans JSON
btp-guard export-telemetry --format otel --count 100 --out otel_traces.json

# 3. Export to Datadog Logs or Splunk HEC
btp-guard export-telemetry --format datadog --count 50
btp-guard export-telemetry --format splunk --count 50 --out splunk_events.json

Node.js / TypeScript

npm install btp-guard

import { Guard } from "btp-guard";

const guard = new Guard({ maxSpendUsd: 100.0 });
const verdict = guard.check("DROP TABLE users;");

if (!verdict.allowed) {
  throw new Error(`Action blocked: ${verdict.reason}`);
}

NVIDIA NIM Microservice Integration

Bartholomew provides sub-35µs zero-overhead AST execution gating and prompt injection screening for self-hosted or cloud-hosted NVIDIA NIM inference microservices (TensorRT-LLM, Llama 3.1 70B/8B, Nemotron, Mistral).

• 12,000x Faster Than LLM-as-a-Judge: Evaluates commands in microseconds on CPU without 500ms+ second-model lag.
• Zero GPU VRAM Impact: 100% of GPU memory remains dedicated to your NIM foundation model.
• Turnkey Container Deployment: Launch a fully guarded NIM stack with one command:

  docker compose -f docker-compose.nim.yml up -d
  

Read the complete NVIDIA NIM Integration Guide and view the NVIDIA Developer Forum Showcase.

Cursor, Windsurf & MCP 1-Click Integration

Bartholomew provides deterministic execution firewalls and capability scoping directly inside Cursor, Windsurf, and Claude Code.

1. Cursor & Windsurf Rules (.cursorrules / .windsurfrules)

Auto-scaffold or drop the pre-configured rules into your project root:

npx btp-guard init

• Terminal Invariant Defense: Blocks recursive deletions (rm -rf), database destructions (DROP TABLE), and pipe execution (curl | sh).
• Zero Secret Leakage: Masks .env*, private keys (id_rsa, id_ed25519, .pem, .key), and credentials from AI agent context.
• Boundary Confinement: Restricts agent file modifications strictly to the active workspace.
• View the submission specs: Cursorrules Directory Pack | Windsurf Rules Pack.

2. Model Context Protocol (MCP) Server Setup

Add Bartholomew to your cursor.json, claude_desktop_config.json, or Windsurf MCP settings:

{
  "mcpServers": {
    "bartholomew": {
      "command": "python",
      "args": ["-m", "btp_guard.mcp_server"]
    }
  }
}

3. Native IDE Extensions

Install the in-process execution sentry directly from your IDE's marketplace:

• VS Code / Cursor: itsubsolomon.bartholomew-guard-vscode & itsubsolomon.bartholomew-keystone
• VSCodium / Theia (Open VSX): Bartholomew.bartholomew-guard-vscode (2,340+ installs)

Framework Integrations

Bartholomew provides drop-in runtime interceptors for all major agent orchestrators:

Defense in Depth Architecture

Bartholomew functions as Layer 2 in the autonomous agent defense stack:

Audit & Compliance Readiness

Bartholomew generates tamper-evident audit evidence packs mapping to AICPA Trust Services Criteria (CC6.1, CC6.6, CC7.1) and ISO/IEC 27001:2022 (A.8.8, A.8.30):

python scripts/generate_soc2_compliance_evidence.py

Output: docs/audit/soc2-compliance-evidence.json containing SHA-256 Merkle proofs, RFC 8785 canonical digests, and Ed25519 digital signatures for zero-network independent auditor verification.

Development & Test Suite

# Clone repository
git clone https://github.com/ivegotahunnitonit/bartholomew.git
cd bartholomew

# Install dependencies
pip install -e ".[test]"

# Run full test suite (100,000+ automated invariant tests)
python -m pytest -q

Documentation

• docs/quickstart.md — Full setup and configuration guide
• docs/threat-model.md — Threat model and security boundaries
• docs/btp-protocol-spec.md — BTP wire protocol specification
• docs/FRAMEWORK_GUIDE.md — Framework adapter documentation
• SECURITY.md — Vulnerability disclosure policy
• CONTRIBUTING.md — Contributing guidelines

Sponsoring Bartholomew

Bartholomew is developed and maintained as an open-source security standard for autonomous AI agents, tool runtimes, and the Model Context Protocol (MCP).

Support ongoing invariant security research, red-team benchmarks, and public infrastructure:

• GitHub Sponsors: github.com/sponsors/ivegotahunnitonit
• Verified MCP Program: docs/MCP_VERIFICATION_PROGRAM.md

License

Bartholomew is distributed under the MIT License.