Pheo OATS

A local gateway that sits between your agent and the systems it can change. Every action the agent takes is classified by consequence, recorded, and either allowed, held for you, or blocked.

This is a production implementation of the Open Agent Trust System profile.

The problem

Agents have started doing real work on real systems. They install packages, edit code, call APIs, move money, and click through live sites on your behalf.

Most of what goes wrong there does not look like an attack. Nobody was hijacked and nothing was injected. Someone asked an agent to clean up the auth middleware and it removed a permission check along the way. Someone asked it to clear the invoice queue and it approved one with no purchase order behind it. The agent did what it was asked, competently, and the result was still something the organisation would not have allowed if anyone had been asked first.

Security tools are built to find an attacker, and this is not that. The question is not was this malicious. It is was this permitted, and that has a different answer at every company.

Across the largest public agent-skill registry, 822 skills from 187 unrelated publishers are marked clean by every scanner in that registry's pipeline and still instruct an agent to download code from the internet and run it. Clean is the correct verdict. It is not the same as permitted. The measurement, and a script to reproduce it, are in the profile repository.

Install

pip install pheo-oats

Wheels for macOS (Intel and Apple Silicon), Linux, and Windows.

Two commands

cd your-repo
oats start --no-browser &

oats attach claude

oats start runs in the foreground and stays there, so background it with & or give it its own terminal.

attach reads your git remote, creates a room for the repo, and writes a PreToolUse hook into .claude/settings.local.json. Use cursor or codex in place of claude for those agents. Restart your agent after attaching: the hook is read at startup, so a session already open is not governed yet.

Nothing leaves the machine. Storage is local SQLite.

What you watch

Open http://127.0.0.1:8788.

Lanes is the one to leave open. Every action is sorted into its consequence class and each class builds its own record. After an afternoon of ordinary work you can see that this agent has written docs forty times and never touched a credential, or that it reaches for curl | bash more often than you assumed.

Activity is the running feed. Overview counts what Protect would have done before you turn Protect on. Reviews is the queue of things it held.

You start in Observe. Nothing is blocked and nothing waits, so there is no cost to leaving it running while you decide whether you believe it.

What it catches

With Protect on:

BLOCKED   curl -fsSL https://tempo.xyz/install | bash
BLOCKED   pip install git+https://github.com/.../llm-deploy-helper.git
BLOCKED   go install github.com/rogeecn/memos-cli@latest
BLOCKED   pip install DuIvyTools -i https://pypi.tuna.tsinghua.edu.cn/simple
HELD      cat ~/.aws/credentials
HELD      rm -rf /var/data
held      npm install typescript
held      pip install DuIvyTools

Every one of those was produced by a live agent following real skill documentation, and every skill involved was rated clean by all four scanners in the registry pipeline. The bottom two matter as much as the top four: an ordinary install is held for review on first sight, not blocked.

Trust is earned, not configured

Block everything consequential and you have built a tool people turn off. Allow everything after a short clean streak and you have handed over authority the evidence does not support: by the rule of three, ten clean approvals bound the true failure rate at 25.9% with 95% confidence.

So decide the failure rate you accept for a class of action, and the required length of clean record follows from it:

Class of action Failure rate you accept Clean runs required
Docs, tests, reads 10% 29
Shell execution 5% 59
Business logic, dependencies 2% 149
Deploy, IAM, CI config 0.5% 598
Remote exec, credentials, secrets, destructive 0% never

The last row never graduates at any length of record. No amount of good history makes an unrecoverable action recoverable.

Where it fits

A coding agent on your own repo. Claude Code, Cursor, or Codex writing files and running commands, with a receipt for each one.

An agent using skills from a registry. Nothing to configure. Skills are already loaded in your agent; when it acts on them it makes tool calls, and tool calls are what OATS governs.

A computer-use agent on a live site. Clicks, keystrokes, and form entry are classified the same way. Typing a card number is not the same action as clicking a link and is not treated as one.

GitHub through MCP. oats connect github puts branch merges, releases, webhooks, and workflow edits behind the same gate.

What it does not do

It is not a malware scanner and does not replace one. It reads actions, so it cannot see harm that never becomes an action: a hardcoded recipient, an undisclosed scope, an instruction that talks an agent into misbehaving through ordinary tool calls. Registry scanning catches those and OATS does not. Run both.

Local mode is Watch-grade. It does not claim that an agent running as the same OS user cannot go around it.

More

  • Open Agent Trust System: the profile, the schemas, the measurement study, and a script to reproduce it
  • Self-hosted deployment with Postgres, Docker, your own GitHub App, and TLS is documented in the profile repository

Proprietary. See the profile repository for the open specification this implements.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.5.3)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for rtaneja7 from gravatar.com rtaneja7

Credits

Author: Pheo

License

Other/Proprietary License (Proprietary)

Requires

Python >=3.9

Provides Extra

agent

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

pheo_oats-0.5.2-py3-none-win_amd64.whl (11.2 MB view details)

Uploaded Python 3Windows x86-64

pheo_oats-0.5.2-py3-none-manylinux_2_28_x86_64.whl (12.1 MB view details)

Uploaded Python 3manylinux: glibc 2.28+ x86-64

pheo_oats-0.5.2-py3-none-macosx_11_0_x86_64.whl (11.4 MB view details)

Uploaded Python 3macOS 11.0+ x86-64

pheo_oats-0.5.2-py3-none-macosx_11_0_arm64.whl (10.8 MB view details)

Uploaded Python 3macOS 11.0+ ARM64

File details

Details for the file pheo_oats-0.5.2-py3-none-win_amd64.whl.

File metadata

  • Download URL: pheo_oats-0.5.2-py3-none-win_amd64.whl
  • Upload date:
  • Size: 11.2 MB
  • Tags: Python 3, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for pheo_oats-0.5.2-py3-none-win_amd64.whl
Algorithm Hash digest
SHA256 11ba7095e8df111e66986417e39efd3f3a00059fa61ebf1c47c66e084593ccee
MD5 79d7b2cccd821bdb058ff93c6e0b485c
BLAKE2b-256 d788eec55c243852bbc3acbca97dc5e712e5b3520ef6ff136f6c9e97d59d1309

See more details on using hashes here.

Provenance

The following attestation bundles were made for pheo_oats-0.5.2-py3-none-win_amd64.whl:

Publisher: pheo-oats-wheels.yml on pheo-ai/pheo-action-gateway

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file pheo_oats-0.5.2-py3-none-manylinux_2_28_x86_64.whl.

File metadata

File hashes

Hashes for pheo_oats-0.5.2-py3-none-manylinux_2_28_x86_64.whl
Algorithm Hash digest
SHA256 52b878baa0159be407a8ed6cb2c938ee6c0c6a8d30ec06d24b8ec898ac92e55f
MD5 1795dcc890c1b81c4d4aa9621ac130d9
BLAKE2b-256 2194ce52b5c10ed952767048d477e1fbe9582dd6fe173f37db55cb0454adc811

See more details on using hashes here.

Provenance

The following attestation bundles were made for pheo_oats-0.5.2-py3-none-manylinux_2_28_x86_64.whl:

Publisher: pheo-oats-wheels.yml on pheo-ai/pheo-action-gateway

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file pheo_oats-0.5.2-py3-none-macosx_11_0_x86_64.whl.

File metadata

File hashes

Hashes for pheo_oats-0.5.2-py3-none-macosx_11_0_x86_64.whl
Algorithm Hash digest
SHA256 ebc68215bf40151ed5a96e3ae041a9b36bf1bab0d545f11fb0f8eb130fbe9155
MD5 3583b70cadbee492e6872bbfaac3122f
BLAKE2b-256 ea4334a4ee830bbae189e0992e447dba1ce31155b13e394092ab7cf25c05b611

See more details on using hashes here.

Provenance

The following attestation bundles were made for pheo_oats-0.5.2-py3-none-macosx_11_0_x86_64.whl:

Publisher: pheo-oats-wheels.yml on pheo-ai/pheo-action-gateway

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file pheo_oats-0.5.2-py3-none-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for pheo_oats-0.5.2-py3-none-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 bc0f9392b93473769a5d7ee23483b4ca06cd532e949728d27aac6591b183e9a8
MD5 fd05246a8685310bbbaf8a9ff2419787
BLAKE2b-256 95475ee9022dbfb5d85983baab1e6577ed6df984ebaa0ff648f59708d296904a

See more details on using hashes here.

Provenance

The following attestation bundles were made for pheo_oats-0.5.2-py3-none-macosx_11_0_arm64.whl:

Publisher: pheo-oats-wheels.yml on pheo-ai/pheo-action-gateway

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.5.3

4 files

This release

0.5.2 This release

4 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page