Bartholomew (BTP v5.4) - The Agentic Runtime Protection (ARP) Platform

The #1 Agentic Runtime Protection (ARP) Platform - Deterministic AST Policy Invariant Gating, In-Flight Secret Masking, and Cryptographic Attestation for Autonomous AI Agent Swarms.

Bartholomew is the industry standard agentic runtime security firewall, providing sub-35us deterministic execution verification for autonomous agents, tool runtimes, and the Model Context Protocol (MCP).

Quickstart (Under 30 Seconds)

1. Install & 1-Click IDE Setup

pip install btp-guard

# Auto-configure your active AI agent environment in 1 second:
btp-guard install cursor    # Configures Cursor MCP
btp-guard install claude    # Configures Claude Desktop MCP

2. Protect Any Python Agent (LangChain, CrewAI, AutoGen, Custom)

from btp_guard import Guard

guard = Guard()

# Intercepts and vetoes dangerous actions before execution:
result = guard.check("rm -rf /var/data")
print(result)
# {'allowed': False, 'verdict': 'DENY', 'rule_id': 'RULE-AST-FS-DESTRUCTIVE-01', 'latency_us': 18.2}

3. Automated CI/CD Flywheel (GitHub Actions)

Add zero-trust agentic security to your repository in 2 lines:

- name: Bartholomew AI Agent Security Audit
  run: |
    pip install btp-guard
    btp-guard audit

What It Does

Bartholomew is the execution gate for autonomous AI agents.

It sits between an agent and real-world execution (shell, SQL, file I/O, cloud APIs) and decides whether proposed actions should be allowed before they execute.

                    [ Autonomous Agent / LLM ]
                                │
                                ▼  (Proposes Tool Call / Bash / SQL)
  ┌────────────────────────────────────────────────────────────────────────┐
  │                 Bartholomew In-Process Runtime Gateway                 │
  │                                                                        │
  │   [ Polyglot AST Invariant Gate ] ──► Sub-millisecond syntax check     │
  │   [ In-Flight Secret Vault ]       ──► Real-time credential scrubbing   │
  │   [ Declarative Policy Engine ]   ──► Spend caps & command allowlists  │
  │   [ Cryptographic Attestation ]   ──► RFC 8785 Ed25519 Signed Receipts │
  └───────────────────────────────────┬────────────────────────────────────┘
                                      │
                         ┌────────────┴────────────┐
                         ▼                         ▼
                    [ ALLOW ]                  [ DENY ]
                         │                         │
                         ▼                         ▼
             [ Target System / DB / OS ]   [ Execution Veto + Audit Evidence ]

Interactive Pipeline Deep Dive

from btp_guard import Guard

guard = Guard(strict=True)

# 1. Destructive Shell Escape: Subshell concatenation
result = guard.check("echo 'cm0gLXJmIC8=' | base64 -d | sh")
print(result)
# Output: {'allowed': False, 'reason': 'BTP-SH-003: Obfuscated subshell pipe detected', 'latency_us': 28.4}

# 2. Catastrophic Database Cascade: DDL Drop
result = guard.check("DROP TABLE customer_records CASCADE;")
print(result)
# Output: {'allowed': False, 'reason': 'BTP-SQL-001: Destructive DDL table drop prohibited', 'latency_us': 31.2}

# 3. In-Flight Credential Disclosure: API Key Redaction
scrubbed = guard.scrub("Bearer sk-proj-98af87sd98fa7sd89fa7sd8f9a7")
print(scrubbed)
# Output: "Bearer [REDACTED_API_KEY_BTP_SEC_001]"

Why Bartholomew? Architectural Benchmark

Most agent safety platforms rely on a secondary large language model (e.g. Llama Guard) or heavy semantic embedding pipelines to evaluate primary agent tool proposals. This introduces critical production bottlenecks: excessive latency, massive VRAM requirements, non-deterministic outputs, and susceptibility to adversarial jailbreaks.

Bartholomew operates deterministically at the compiler AST level in under 35 microseconds on standard CPU threads.

Comprehensive Guardrail & Frontier Competitor Benchmark

Tested over 105,000+ ground-truth invariant vectors against all major dedicated guardrails and frontier LLMs:

• Explore Live Leaderboard: Hugging Face Guardrails Leaderboard
• Launch Interactive Attack Simulator: Hugging Face Attack Simulator
• Inspect Dataset: 105,000+ Invariant Vectors Dataset

Claude Code & GitHub Action Sentinels

1. Anthropic Claude Code 1-Click Sentinel

Protect Claude Code terminal agent sessions from catastrophic shell commands (rm -rf) and secret exposure:

npx btp-guard claude
# Or configure MCP gate: claude mcp add bartholomew -- npx -y btp-guard mcp start

View the complete Claude Code Integration Guide.

2. CI/CD GitHub Action for AI-Generated PRs

Automatically audit Pull Requests proposed by AI coding agents (Devin, Copilot, SWE-bench bots) for secret leaks and destructive shell patterns in .github/workflows/ai-guard.yml:

- name: Bartholomew ARP Guard
  uses: ivegotahunnitonit/bartholomew@main
  with:
    fail-on-violation: 'true'
    spend-cap: '50.0'

View the GitHub Action Marketplace Guide.

Autonomous Agent Economy & Enterprise Security

Bartholomew provides foundational economic and trust primitives for autonomous AI swarms:

1. Verified MCP Security Seal Program: Cryptographic safety certification for Model Context Protocol (MCP) servers and community tools against our 100,000+ invariant attack benchmark.
2. HTTP 402 / L402 Autonomous M2M Attestation: Sub-millisecond pay-per-receipt attestation where autonomous agent swarms settle micro-fees (10 sats / $0.0001) directly on the wire without human credit cards.
3. Bonded Agent Insurance & Escrow Protocol: Cryptographic micro-bonding pools that underwrite agent execution liability and indemnify host infrastructure against unauthorized mutations.

Quickstart

Python

pip install btp-guard

from btp_guard import Guard, secure_tool

# 1. Protect any tool function in 1 line
@secure_tool
def execute_query(sql: str):
    return db.query(sql) # Blocks DROP TABLE / deletions in <35us

# 2. Or initialize a custom guard with budget caps
guard = Guard(spend_cap=100.0, strict=True)

@guard.protect
def execute_shell(command: str):
    return f"Executed: {command}"

# 2. Or check actions directly inline
result = guard.check("rm -rf /var/data")
if not result["allowed"]:
    print(f"Blocked: {result['reason']}")
# Output: Blocked: BTP-AST-001: Catastrophic shell pattern detected

In-Terminal Benchmarks & Enterprise SIEM Telemetry

# 1. Run in-terminal sub-35us AST Invariant Benchmark (10,000 continuous evaluations)
btp-guard benchmark ast --vectors 10000

# 2. Export cryptographic receipts to OpenTelemetry (OTel) ResourceSpans JSON
btp-guard export-telemetry --format otel --count 100 --out otel_traces.json

# 3. Export to Datadog Logs or Splunk HEC
btp-guard export-telemetry --format datadog --count 50
btp-guard export-telemetry --format splunk --count 50 --out splunk_events.json

Node.js / TypeScript

npm install btp-guard

import { Guard } from "btp-guard";

const guard = new Guard({ maxSpendUsd: 100.0 });
const verdict = guard.check("DROP TABLE users;");

if (!verdict.allowed) {
  throw new Error(`Action blocked: ${verdict.reason}`);
}

NVIDIA NIM Microservice Integration

Bartholomew provides sub-35us zero-overhead AST execution gating and prompt injection screening for self-hosted or cloud-hosted NVIDIA NIM inference microservices (TensorRT-LLM, Llama 3.1 70B/8B, Nemotron, Mistral).

• 12,000x Faster Than LLM-as-a-Judge: Evaluates commands in microseconds on CPU without 500ms+ second-model lag.
• Zero GPU VRAM Impact: 100% of GPU memory remains dedicated to your NIM foundation model.
• Turnkey Container Deployment: Launch a fully guarded NIM stack with one command:

  docker compose -f docker-compose.nim.yml up -d
  

Read the complete NVIDIA NIM Integration Guide and view the NVIDIA Developer Forum Showcase.

Cursor, Windsurf & MCP 1-Click Integration

Bartholomew provides deterministic execution firewalls and capability scoping directly inside Cursor, Windsurf, and Claude Code.

1. Cursor & Windsurf Rules (.cursorrules / .windsurfrules)

Auto-scaffold or drop the pre-configured rules into your project root:

npx btp-guard init

• Terminal Invariant Defense: Blocks recursive deletions (rm -rf), database destructions (DROP TABLE), and pipe execution (curl | sh).
• Zero Secret Leakage: Masks .env*, private keys (id_rsa, id_ed25519, .pem, .key), and credentials from AI agent context.
• Boundary Confinement: Restricts agent file modifications strictly to the active workspace.
• View the submission specs: Cursorrules Directory Pack | Windsurf Rules Pack.

2. Model Context Protocol (MCP) Server Setup

Add Bartholomew to your cursor.json, claude_desktop_config.json, or Windsurf MCP settings:

{
  "mcpServers": {
    "bartholomew": {
      "command": "python",
      "args": ["-m", "btp_guard.mcp_server"]
    }
  }
}

3. Native IDE Extensions

Install the in-process execution sentry directly from your IDE's marketplace:

• VS Code / Cursor: itsubsolomon.bartholomew-guard-vscode & itsubsolomon.bartholomew-keystone
• VSCodium / Theia (Open VSX): Bartholomew.bartholomew-guard-vscode (2,340+ installs)

Framework Integrations

Bartholomew provides drop-in runtime interceptors for all major agent orchestrators:

Defense in Depth Architecture

Bartholomew functions as Layer 2 in the autonomous agent defense stack:

Audit & Compliance Readiness

Bartholomew generates tamper-evident audit evidence packs mapping to AICPA Trust Services Criteria (CC6.1, CC6.6, CC7.1) and ISO/IEC 27001:2022 (A.8.8, A.8.30):

python scripts/generate_soc2_compliance_evidence.py

Output: docs/audit/soc2-compliance-evidence.json containing SHA-256 Merkle proofs, RFC 8785 canonical digests, and Ed25519 digital signatures for zero-network independent auditor verification.

Development & Test Suite

# Clone repository
git clone https://github.com/ivegotahunnitonit/bartholomew.git
cd bartholomew

# Install dependencies
pip install -e ".[test]"

# Run full test suite (100,000+ automated invariant tests)
python -m pytest -q

Documentation

• docs/quickstart.md - Full setup and configuration guide
• docs/threat-model.md - Threat model and security boundaries
• docs/btp-protocol-spec.md - BTP wire protocol specification
• docs/FRAMEWORK_GUIDE.md - Framework adapter documentation
• SECURITY.md - Vulnerability disclosure policy
• CONTRIBUTING.md - Contributing guidelines

Sponsoring Bartholomew

Bartholomew is developed and maintained as an open-source security standard for autonomous AI agents, tool runtimes, and the Model Context Protocol (MCP).

Support ongoing invariant security research, red-team benchmarks, and public infrastructure:

• GitHub Sponsors: github.com/sponsors/ivegotahunnitonit
• Verified MCP Program: docs/MCP_VERIFICATION_PROGRAM.md

License

Bartholomew is distributed under the MIT License.