OpenAPPA

Why it's ranked here

The idea is information-flow control, an established security technique, applied to agent tool calls, with a companion paper accepted at a NeurIPS 2026 workshop. The engineering matches the ambition: MIT licensed, a Rust workspace split into separate engine, policy, runtime and adapter crates, a design that blocks every action when the checker is silent, and an installer that verifies checksums. The project's own benchmarks report zero successful attacks across 1,320 evaluations at 88 to 90 percent task completion, though those numbers come from the authors' harnesses. The README calls it a preview and an RFC whose config may break, which limits production trust for now.

What's good

Determinism is structural, not promised: the engine performs no input or output and reads no clock, so one log always yields one verdict. A policy edit opens new sessions under the new rules while running sessions keep the policy they started with. Failure is closed: a runtime that does not answer means the action is blocked. The opt-in file mode goes further than hooks can, moving reads and writes behind the runtime so a copied file inherits its source's sensitivity even though the model never sees the bytes. The installer pins one release, checks its checksum and refuses archive entries that escape their directory.

Tradeoffs

This is a preview: the README warns config and wire formats may break without compatibility shims, and the file mode is marked draft and experimental. The standalone runtime accepts only the Claude Code harness today; other agents go through embedding or Archestra's proxy. Fail-closed cuts both ways: if the background process stops, every action in a protected session is blocked, including the commands you would use to fix it. Saved integration tokens sit in plaintext at rest, guarded only by Unix file permissions. Release binaries cover Linux and macOS only, and Linux needs glibc 2.34 or newer. The headline benchmark figures are self-run.

How to use it well

It suits teams whose agents touch both private data and public outputs, such as internal documents alongside a public repository or a chat channel. Start with the Claude Code plugin to watch policies decide on real work, then write rules for your actual tools and wire the bundled replay and config-check commands into CI so policy changes are tested before merge. Start the runtime before sessions open. It does not classify content or sign in to MCP connectors on its own: sensitivity comes from the labels and annotators you declare, so the protection is exactly as good as the policy you write.

Observed

License

MIT

Language

Rust (edition 2024 Cargo workspace)

Policy format

Declarative TOML compiled into the engine registry at startup

Interfaces

CLI binary, embeddable Rust library, MCP server, loopback HTTP hook endpoint

Agent hosts

Claude Code plugin; kagent deployment preparation; Archestra LLM proxy

Platform support

Release binaries for Linux and macOS on x86_64 and aarch64; Windows via zip from the releases page

Install surface

curl installer with SHA256 verification, or cargo install from a checkout

Storage

Bundled SQLite event log; PostgreSQL behind a build feature

Project status

Preview and RFC per the README; file mediation mode marked draft

Benchmarks in repository

Corp, AgentThreatBench and Tau harnesses, rule-scored except one LLM-judged Tau task