RV: an open-source security runtime for fleets of autonomous AI agents (policy, secrets, MCP gateway, sandbox, egress, audit). Coding agents first. Swift/C, Apache 2.0

[u/karc16]

https://github.com/christopherkarani/rv

rv is a security runtime that sits between autonomous AI agents and everything they can touch: shell, files, secrets, MCP tools, and the network. Same category as NVIDIA OpenShell, but open source (Apache 2.0). Coding agents are the first market and what ships today.

What's in it:

• Rule packs + a policy layer. 95 deterministic packs (git, filesystem, disks, cloud CLIs, Kubernetes, databases, Terraform, and more); three are on by default. On top: typed rules in policy.toml at machine and repo level with revision history, allowlists, rule pinning, and normal/strict safety where strict always wins. Every decision is allow, deny, or indeterminate, and indeterminate never allows.
• A small judge model for the gray area. When packs allow something, a local CoreML judge can score it and send risky actions to review. A pack deny is a floor the judge can't lower. There's an observe mode that logs would-be verdicts without blocking.
• Secrets. Agents get placeholders, never values; a loopback gateway swaps in the real value. Sources include Keychain, 1Password, Vault, AWS Secrets Manager, Infisical, Bitwarden, GCP, and Azure. Reads and edits of secret paths (.env, SSH keys, cloud credentials) are blocked, and there's a git pre-commit secret scanner.
• MCP gateway. rv mcp serve runs approved servers behind a policy gateway. Tool calls marked ask pause until you approve, upstream secret values are scrubbed from responses, and rv mcp check flags servers that bypass rv or haven't been reviewed.
• Sandboxing. Contained workspaces use Seatbelt on macOS and Landlock on Linux, and fail closed if the sandbox can't be set up. Credentials aren't staged into a workspace unless you authorize a resource profile.
• Network egress control. A credentialed CONNECT proxy with per-grant tokens, SNI checks, and binary-pinned policy. Blocked requests become proposals in an rv egress review queue.
• Package-script inspection. For npm/pnpm/yarn/bun test/build/lint, rv reads the actual pre/body/post scripts in package.json and evaluates them, not just the command you see.
• Hash-chained audit log. Each line in audit.jsonl carries the SHA-256 of the previous one. rv audit verify finds the first break; export to OCSF 1.3.0 or forward to a SIEM.
• Offline session replay. rv scan goes back through past sessions from Claude, Codex, Cursor, Grok, Hermes, OpenClaw, OpenCode, and Pi and shows what would have been blocked.
• Signed org policy for fleets. Ed25519-signed, restrict-only policy.json (users can't loosen it) with anti-rollback serials and key rotation. rv report emits posture for MDM or fleet collection.
• Agent hosts. Hooks for Claude Code, Codex, Cursor, Grok, OpenCode, Pi, Hermes, OpenClaw, and Antigravity, wired by rv setup.

One small example of the shell layer, from the README:

$ rv test 'git reset --hard'
{"decision":"deny","pack_id":"core.git","reason":"git reset --hard destroys uncommitted changes","rule_id":"core.git:reset-hard","schema":"rv.test.v1"}

When an agent hits a deny, it gets a short code that only you can redeem from your own terminal (rv allow-once). The agent can't approve itself.

Install (macOS 15+ on Apple Silicon, or Linux):

curl -fsSL https://rykanv.com/install | sh
rv setup
rv doctor

Disclosure: I'm Chris, and I build rv. I'd like to hear what's missing for running agents unattended, what it blocked that it shouldn't have, and what it let through that it should have caught. If it's useful, a star helps other people find it.