bastionfuse
containKill switch and tripwires for agents
Stops an agent that is already misbehaving, whether or not any detector saw the injection: honeytokens, decoy files, decoy tools and action budgets trip a sticky fuse.
pip install bastionfuse Operator-written rules (honeytokens, decoys, budgets you write) enforce; built-in default budgets and the repeat detector only log. Tamper-evident, not tamper-proof, against an agent running as your user: read the README Limits.
What it does
- Watches what the agent does, not what its text says: the backstop for when every text detector misses
- Honeytokens and decoy files (bastionfuse plant): an agent that reads a decoy and then tries to send data out is stopped
- Decoy MCP tools no legitimate flow calls; budgets on calls, egress, destructive actions, hosts and bytes
- Sticky, per-session trips: kill, degrade (read-only tools keep working) or pause for review; an operator KILL file stops every session
- Claude Code hook that fails closed, with a watchdog that denies before the hook timeout; also a Python library
- Trip snapshots as bastiontrace traces, and bastionfuse demo: a scripted attacker vs the fuse, no API key
Quickstart
bastionfuse demo # scripted attacker vs the fuse, no API key
bastionfuse plant --dir ~/projects/myapp
bastionfuse install-hook # prints the Claude Code settings block
Version 0.1.1 · MIT