A local Agent Firewall
and MCP Gateway.
Constraint Native sits in-process with the coding agent, between the agent and the workspace. Files, shell, MCP tools, and network all flow through a single governed boundary — every meaningful event signed into a chain a reviewer can replay offline.
Hierarchy: Golem governs claim state before speech; Constraint Native carries that discipline into tool, file, shell, MCP, and network action before execution.
Coding agents are starting to touch real repositories, shell commands, MCP tools, files, and network paths. Teams need to know what the agent read, what it wrote, what it tried to exfiltrate, what was blocked, and how to replay the session later. Constraint Native turns that into a local proof path.
Four governance verbs.
One signed chain.
Allow, Quarantine, Deny, Verify. Every action the agent attempts maps to one of these states. Reviewers, security teams, and policy authors all read the same vocabulary.
Capability brokering
Path-scoped file access, MCP-server-scoped tool use, shell exec under approval, network egress allowlist. Default-deny posture.
Taint tracking
Tool output flagged as untrusted is held outside durable memory and downstream context until policy decides to lift the taint.
Bounded denial
Writes outside scope, network egress to unallowed destinations, canary-secret patterns, and elevated shell — denied without ambiguity, recorded into the proof path.
Signed proof path
Every event hashes into an ed25519 chain. The chain is a single replayable artifact: a reviewer can verify offline, no telemetry required.
Local. In-process.
No agent traffic egress.
Constraint Native is intentionally narrow. It is not a hosted gateway, not a cloud broker, and not a sidecar that forwards prompts. It is the local boundary the agent already wants to be on the other side of.
What a session looks like.
A representative shape from the deterministic Agent Firewall demo. Eleven events, four policy blocks, two quarantines, one denied write, one denied network attempt, one canary-secret block, valid ed25519 chain.
What ships today.
Bounded by design. The current alpha is macOS, in-process with the coding-agent client, governing files, shell, MCP, and network for a single developer's workspace.
Review the governed-action
proof path.
For grant, fellowship, or security review, the next step is a fresh proof export from a scoped macOS-alpha workflow: installer notes, short walkthrough, signed event chain, and replayable artifact.