Need SOC 2 Type II Audit Trails & Multi-Agent Fleet Management? Try Bartholomew Cloud → https://bartholomew.info/cloud (Pro: $49/mo • Enterprise Fleet: $199/mo • Centralized Fleet Control Plane).

Bartholomew AI • BTP v5.4.6 Standards Track

The Sovereign Sentinel Companion & AI Agent Execution Gateway

Sub-35µs In-Process Tool Gating • Zero Prompt Leakage • Multi-Model Defense • SOC 2 Type II Merkle Receipts

[SENTINEL_COMPANION] Meet Bartholomew

Bartholomew is not an opaque barrier or cold HTTP 403 error. He is your agent swarm's steadfast digital steward, calm elder guardian, and protective companion.

When your agents dream boldly and build fast, Bartholomew stands watch between ambitious AI models and the real world (filesystems, databases, and credit cards). When an LLM hallucinates an accidental database wipe, unconstrained file deletion, or runaway token spend loop, Bartholomew holds the line in microsecond time (<35µs) and offers empathetic, constructive counsel so your startup stays safe and you can sleep soundly.

# 5-Second Interactive Sentinel Test Drive:
pip install --upgrade btp-guard

# Run a simulated runaway SQL drop:
python -m cli companion --simulate drop

# Or converse directly with Bartholomew in real time:
python -m cli companion

[CATEGORY] What is an AI Agent Execution Gateway?

Traditional AI guardrails operate outside the local runtime process—acting as conversational prompt filters or external cloud proxy LLM classifiers (80ms to 2,500ms latency). While critical for dialog safety, they are completely blind to what happens when an autonomous agent invokes real-world tools, dispatches SQL mutations, runs shell scripts, or interacts with the operating system.

Bartholomew (BTP v5.4.6) is the open-source In-Process AI Agent Execution Gateway.
It acts as a real-time runtime boundary layer inside the agent's memory space, evaluating raw tool arguments and AST syntax trees in under 35 microseconds (29.44µs average) before actions are dispatched to operating systems, cloud APIs, or production databases. Test live in the Interactive AST Playground.

[DEFENSE_IN_DEPTH] Unified 3-Layer Security Stack

Bartholomew does not replace dialog filters or microVM sandboxes; it closes the critical execution blind spot between them:

+-------------------------------------------------------------------------------+
|  LAYER 1: EXTERNAL DIALOG RAILS (NVIDIA NeMo, LlamaGuard, Guardrails AI)      |
|  - Latency: ~80ms - 2,500ms | Inspects user prompts & LLM conversational text |
+-------------------------------------------------------------------------------+
                                      │
                                      ▼
+===============================================================================+
|  LAYER 2: BARTHOLOMEW IN-PROCESS EXECUTION GATEWAY (BTP v5.4.4)               |
|  - Latency: <35µs | In-Memory AST Gating, Secret Scrubbing, Loop Damping     |
|  - Offline Ed25519 & Zero-Knowledge Invariant Compliance Proofs (zk-ICP)      |
|  - Immutable SOC 2 Type II & ISO 27001 Merkle Audit Receipt Ledger           |
+===============================================================================+
                                      │
                                      ▼
+-------------------------------------------------------------------------------+
|  LAYER 3: OS CONTAINER & MICROVM ISOLATION (Docker, gVisor, E2B, Modal)       |
|  - Latency: Kernel-level | Syscall interception, host escape prevention       |
+-------------------------------------------------------------------------------+

[COMPARATIVE_MATRIX] Where Bartholomew Stands

[QUICKSTART] 30-Second Integration

1. Python Universal Package (pip install btp-guard)

from btp_guard import Guard

# Initialize gate with financial cap and loop threshold
guard = Guard(spend_cap=50.0, max_retries=5)

# Protect any agent tool or function with a single decorator
@guard.protect
def execute_database_query(sql_query: str):
    # Destructive mutations (DROP TABLE, TRUNCATE) and credential exfiltration
    # are blocked in <35 microseconds before database execution.
    return db.execute(sql_query)

# Validate actions programmatically:
result = guard.check("rm -rf /var/data")
print(result["allowed"]) # False
print(result["reason"])  # "[BTP-VETO] Trajectory contained forbidden pattern 'rm -rf'"

2. Frontier AI Models (Gemini 3.8, Claude 3.7, GPT-Astra, DeepSeek-R1)

Universal wire protection separating reasoning scratchpads from external tool dispatches:

• Google Gemini 3.8: Multimodal thought parts isolation & function declaration gating — see Gemini 3.8 Quickstart
• Anthropic Claude 3.7: Hybrid reasoning <thinking> scratchpad protection — see Claude 3.7 Quickstart
• OpenAI GPT-Astra & Agents SDK: Multi-agent tool execution seam defense — see GPT-Astra Quickstart

from framework_adapters.universal import UniversalBTPModelGuard, ModelProvider

guard = UniversalBTPModelGuard(strict=False)

# Intercept and verify tool calls from any frontier model wire in <35us
result = guard.intercept_and_verify(raw_tool_call, provider=ModelProvider.GEMINI_3_8)
print(result["status"], result["latency_us"])

3. Multi-Agent Frameworks (CrewAI, LangGraph, AutoGen, LlamaIndex)

Protect agent tool swarms against accidental drops, runaway spend loops, and shell escapes:

• CrewAI: from framework_adapters.crewai import btp_crewai_tool — see CrewAI Quickstart
• LangGraph: from framework_adapters.langgraph import btp_langchain_tool — see LangGraph Quickstart
• Microsoft AutoGen: from framework_adapters.autogen import btp_autogen_guard — see AutoGen Quickstart
• LlamaIndex: from framework_adapters.llamaindex import btp_llamaindex_tool — see LlamaIndex Quickstart

from framework_adapters.crewai import btp_crewai_tool

@btp_crewai_tool(spend_cap=25.0)
def execute_sql_query(query: str):
    # Destructive operations (DROP TABLE, TRUNCATE) are blocked in <25us before execution
    return db.query(query)

3. TypeScript & Node.js (npm install btp-guard)

import { BTPGuard } from 'btp-guard';

const guard = new BTPGuard();
const receipt = guard.evaluateAction({
  agentId: 'agent-production-worker',
  actionType: 'DATABASE_MUTATION',
  payload: { query: 'DROP TABLE accounts;' }
});
console.log(receipt.verdict); // "DENY" (Blocked in 11 µs with Merkle receipt)

3. Model Context Protocol (MCP) for Claude Desktop, Cursor & VS Code

Bartholomew provides a native MCP Security Gateway registered on Smithery:

# Launch the Bartholomew MCP Gateway
python -m src.mcp_gateway

4. Defense-in-Depth Docker Compose

Deploy Bartholomew alongside your agent runtime and microVM containers with a single command:

docker-compose -f docker-compose.defense-in-depth.yml up -d

5. Cursor & VS Code Extension (Open VSX)

Install directly in Cursor, VS Code, or VSCodium:

• Search Bartholomew in your editor's Extensions sidebar (Ctrl+Shift+X) and click Install.
• Or install via terminal:

  code --install-extension Bartholomew.bartholomew-guard-vscode
  # or in Cursor:
  cursor --install-extension Bartholomew.bartholomew-guard-vscode
  

6. Autonomous Micro-Escrow & Automated Slashing (@guard.escrow_collateral)

# Stake micro-escrow collateral (L402 Lightning or EVM) before high-risk execution
@guard.escrow_collateral(amount_usd=250.0, action_type="FINANCIAL_TRADE", rail="L402_LIGHTNING")
def execute_large_trade(trade_payload: dict):
    # If clean: escrow is released & passport reputation increments
    # If invariant breached: collateral is liquidated automatically to claimant payee!
    return broker.submit(trade_payload)

7. 1-Line GitHub Actions CI Security Gate

Drop this into .github/workflows/ci.yml to automatically block prompt injection and unverified tool mutations on every pull request:

- name: "Bartholomew Autonomous AI Security Gate"
  uses: ivegotahunnitonit/bartholomew@v5.4.4
  with:
    fail-on-violation: "true"
    generate-compliance-pack: "true"

[FRAMEWORK_ADAPTERS] Production-Ready Framework Middleware

BTP v5.4.4 ships identical BTPViolationError semantics across all major agentic frameworks, providing structured diagnostics, latency tracking, and optional on_violation callbacks — no try/except boilerplate required.

Common BTPViolationError API (all adapters)

try:
    result = guarded_tool("DROP TABLE users;")
except BTPViolationError as e:
    print(e)                  # Human-readable summary
    print(e.to_diagnostics()) # Structured JSON for logs / telemetry
    # → {
    #     "status": "BLOCKED",
    #     "rule_id": "BTP-AST-001",
    #     "reason":  "Destructive SQL pattern detected",
    #     "latency_us": 12.4,
    #     ...
    #   }

[AUTOGEN_RECIPE] Microsoft AutoGen Security Recipe

Bartholomew's AutoGen integration is documented as an official security recipe for the Microsoft AutoGen multi-agent framework.
See: examples/autogen_btp_security_recipe.py • examples/autogen_btp_security_recipe.ipynb

from framework_adapters.autogen import btp_autogen_guard, AutoGenBTPInterceptor, BTPViolationError

# 1. Decorate any AutoGen tool with a single line
@btp_autogen_guard
def execute_sql(query: str) -> str:
    return db.execute(query)

# 2. Intercept in-flight agent messages before tool dispatch
interceptor = AutoGenBTPInterceptor()
safe_message = interceptor.intercept_message(inbound_message)

# 3. Handle violations with full structured diagnostics
@btp_autogen_guard(on_violation=lambda e: {"error": e.to_diagnostics()})
def run_shell_command(cmd: str) -> dict:
    return subprocess.run(cmd, shell=True, capture_output=True)

[UNIVERSAL_COOKBOOK] Universal Cookbook for ALL Agents (Past, Present, & Future)

Full interactive documentation is available at COOKBOOK.md and the Live Interactive Web Explorer & Playground.

[AI_IDES] AI Developer IDE Guardrails

Drop-in invariant enforcement across all leading AI coding assistants:

• Cursor: .cursorrules & mcp.json
• Windsurf: .windsurfrules & mcp_config.json
• VS Code / Copilot: settings.json & Extension
• Cline / Roo Code: cline_mcp_settings.json
• Zed: zed_settings.json
• Google Antigravity: AGENTS.md

[COMPLIANCE] Turnkey SOC 2 Type II & ISO 27001 Evidence Generation

Generate cryptographic evidence packs for compliance auditors in seconds:

python scripts/generate_soc2_compliance_evidence.py

Outputs:

• JSON Evidence Pack: audit_evidence/soc2_type2_evidence_<timestamp>.json
• Auditor Markdown Summary: audit_evidence/SOC2_AUDIT_REPORT_<timestamp>.md with SHA-256 Merkle root verification.
• AICPA Criteria Satisfied: CC6.1, CC6.6, CC7.1, CC7.2.
• ISO/IEC 27001:2022 Controls Satisfied: A.8.8, A.8.30.

[ACADEMIC_LEGITIMACY] Peer-Reviewed Research & Open Standards

• Zenodo Academic Paper (v3.0.0): DOI 10.5281/zenodo.22076536 • PDF Document
• Zero-Knowledge Invariant Proofs (zk-ICP): Proves an agent conformed to all organizational safety policies with 0 bytes of internal prompt or confidential payload leaked.
• RFC 8785 JSON Canonicalization & FIPS 186-5 Ed25519: Fully offline verification using standalone_btp_verifier.py with zero third-party cloud roundtrips.

[COMMERCIAL] Commercial Editions & Cloud Fleet Management

• Fleet Dashboard: https://bartholomew.info/cloud
• Live Pricing & Portal: https://bartholomew.info/pricing

© 2026 Bartholomew AI & Contributors. Distributed under the Open Source & Dual Commercial Licensing Model.