scroll ↓

// every tool call, checked

Every tool call stops at a gate.

ZeroTruss sits between an AI agent and its tools. Every call is allowed or denied, and every decision is logged.

View on GitHub Open source. Transparent.

how one call travels (simplified)

result

agent

call

deny

gateway

allow / deny

ZeroTruss checkpoint

run

logs

tool

Fail safe.

// the problem

An agent that can run tools can touch real things.

01 / REACH

Files and systems

Once an agent can run tools, it can read and change what those tools can reach.

02 / PROOF

No record

Afterwards, nobody can show what the agent was allowed to do, or what it actually did.

03 / TRUST

Taken on faith

Without a checkpoint and a record, safe behaviour is something you hope for, not something you can check.

// the checkpoint

One gate. Allowed or denied. Nothing in between.

STEP 1

The call stops

Every tool call is paused at the gateway before it runs. It works with agentgateway over MCP.

STEP 2

The checkpoint answers

The gateway asks ZeroTruss "is this allowed?" and gets a yes or a no.

STEP 3

Safe when it fails

If the checkpoint cannot be reached, the gateway lets nothing through unchecked. With the gateway set to fail closed, a fault never opens the gate.

MCP (Model Context Protocol) is a common way for AI agents to call tools, such as one that reads files. agentgateway is a gateway that sits between AI agents and their tools. Fail safe, also called fail closed, means that when something breaks, the safe answer wins and the call does not run.

// the rules

A small signed file says what is allowed.

Which tools, which folders, and until when.
Anything not listed is denied.
The agent never supplies its own rules.
Changing the file without the signing key makes the checkpoint refuse to start.

Ed25519 is a standard digital signature: only the holder of the private key can sign, and anyone with the public key can check the signature. Built and used on macOS, where the signing key is kept in the Keychain. The pipeline runs the tests on Linux.

RULES FILE (public example, list shortened)

allowed_tools: ["read_text_file", "list_directory", "search_files", ...]
allowed_folders: ["/absolute/path/to/the/folder/the/agent/may/use"]
expires_at: "2030-01-01T00:00:00Z"

SIGNEDEd25519. Private key kept in the macOS Keychain.

// the log

Every decision is written down, and chained.

Each entry carries a hash of the entry before it. Edit an entry, or take one out of the middle, and the chain stops matching. A separate checker verifies it. Cutting off the end of the log, or rebuilding the whole chain, is not caught.

entry 1matches

entry 2matches

entry 3edited

entry 4no longer matches

checker (illustration) entry 3 does not match its hash.

// a log entry

What one entry looks like.

example entry, made-up ids (hashes shortened with ...)

seq: 2
ts: 2026-11-07T22:36:13.882559+00:00
kind: request
tool: write_file
args_hash: 91273e09...bc1b
decision: deny
reason: tool not allowed: write_file
tool_use_id: toolu_example_0002
call_id: 66666666-7777-8888-9999-000000000000
trace_id: 00000000000000000000000000000002
prev_hash: b6c52cf5...7475
hash: 105e74d2...c121

The log stores a fingerprint (hash) of the arguments, not the arguments themselves, and a deny reason never contains a file path.

This entry's prev_hash is the hash of entry 1 (b6c52cf5...7475). That is the link in the chain.

// transparency

Every dependency, with its exact version.

The full software bill of materials, open for anyone to inspect. It is generated by our build pipeline on every push and checked against the CycloneDX 1.6 schema.

CycloneDX is a standard format for a software bill of materials, which is a list of the parts software is made of.

runtime components 6

format CycloneDX 1.6

versions exact, hash-pinned, prebuilt packages only

Runtime dependencies with version, license and where they are used
Component	Version	License	Used in
cffi	2.1.1	MIT-0	Runtime, needed by cryptography
cryptography	50.0.2	Apache-2.0 OR BSD-3-Clause	Runtime, direct
grpcio	1.84.1	Apache-2.0	Runtime, direct
protobuf	7.36.2	3-Clause BSD License	Runtime, direct
pycparser	3.12	BSD-3-Clause	Runtime, needed by cffi
typing_extensions	4.16.0	PSF-2.0	Runtime, needed by cryptography and grpcio

67 tools used to build and check (names and versions, including the SBOM tool's own environment)

Not part of what runs. They are listed from the lock files, which pin each one to an exact version.

arrow 1.4.0
attrs 26.1.0
boolean-py 5.0
build 1.6.1
cachecontrol 0.14.4
certifi 2026.10.23
chardet 7.7.0
charset-normalizer 3.5.2
click 8.5.0
cyclonedx-bom 7.5.0
cyclonedx-python-lib 11.12.0
defusedxml 0.7.1
filelock 4.2.4
fqdn 1.6.0
grpcio-tools 1.84.1
idna 3.20
iniconfig 2.3.1
isoduration 20.11.0
jaraco-classes 3.4.0
jaraco-context 6.1.2
jaraco-functools 4.6.0
jeepney 0.9.0
jsonpointer 3.4
jsonschema 4.26.0
jsonschema-specifications 2025.9.1
keyring 25.7.0
lark 1.3.1
license-expression 30.4.4
lxml 6.1.3
markdown-it-py 4.2.0
mdurl 0.1.2
more-itertools 11.2.1
msgpack 1.2.3
packageurl-python 0.17.6
packaging 26.3
pip 26.2.2
pip-api 0.0.35
pip-audit 2.10.1
pip-requirements-parser 32.0.1
pip-tools 7.6.2
platformdirs 4.13.5
pluggy 1.7.0
py-serializable 2.1.0
pygments 2.21.0
pyparsing 3.3.3
pyproject-hooks 1.3.3
pytest 9.1.1
python-dateutil 3.0.0
referencing 0.37.0
requests 2.34.2
rfc3339-validator 0.1.4
rfc3986-validator 0.1.1
rfc3987-syntax 1.1.0
rich 15.0.0
rpds-py 2026.9.1
secretstorage 3.5.0
setuptools 84.2.1
six 1.17.0
sortedcontainers 2.4.0
tomli 2.5.0
tomli-w 1.2.0
typing-extensions 4.16.0
tzdata 2026.5
uri-template 1.3.0
urllib3 2.8.0
webcolors 25.10.0
wheel 0.48.0

Download sbom.cdx.json The SBOM is rebuilt on every push and checked against the CycloneDX schema. Snapshot of commit dcdcec9, 7 Nov 2026.

// verifiable facts

What can be checked today.

Measured on commit dcdcec9, 7 Nov 2026.

196

automated tests

14 days

Checked on every push: no dependency under 14 days old

Exact versions, with hashes
Every dependency is pinned and installed from prebuilt packages only.
Vulnerability audit runs on every push
On every lock file (pip-audit).
Secret scan of the whole history
Runs on every push.
Signed rules
Ed25519. Private key in the macOS Keychain.
Hash-chained audit log
With a validator.
Apache-2.0 licensed
CycloneDX SBOM
Generated on every push.

// what's inside

What it covers.

INCLUDED

The checkpoint
Boundary rules, with expiry
The signed boundary
The audit log and its checker
Locked and audited dependencies
The SBOM