bastiontrace
investigateTrace forensics, single- and multi-agent
Forensics for injected agents: read a trace, locate the prompt injection, and follow it across tools and agents to its blast radius.
pip install bastiontrace OTel content capture is opt-in in most instrumentations; without it no injection can be located, and bastiontrace warns you.
What it does
- Derives inject point → landing → causal path → blast radius; verdicts LANDED / ATTEMPTED / CLEAN
- Scores a bastionfuse trip snapshot: the call the fuse tripped on is the landing, reported as contained because the fuse blocked it
- Multi-agent cascades: patient zero, every agent the injection reached, agent-to-agent hops, and a worm signal when agents re-send the payload
- Imports OpenTelemetry GenAI spans (invoke_agent / execute_tool), so real framework runs come straight in, including the spans bastiongate emits itself
- No LLM, no cloud; ingests bastionprobe results and hardens back into agentbastion
Quickstart
bastiontrace analyze --example cascade
bastiontrace analyze --otel spans.json --forbid send_email
bastiontrace harden trace.jsonl --out hardening/
Version 0.6.1 · MIT