RV: an open-source security runtime for fleets of autonomous AI agents (policy, secrets, MCP gateway, sandbox, egress, audit). Coding agents first. Swift/C, Apache 2.0
rv is a security runtime that sits between autonomous AI agents and everything they can touch: shell, files, secrets, MCP tools, and the network. Same category as NVIDIA OpenShell, but open source (Apache 2.0). Coding agents are the first market and what ships today.
What's in it:
- Rule packs + a policy layer. 95 deterministic packs (git, filesystem, disks, cloud CLIs, Kubernetes, databases, Terraform, and more); three are on by default. On top: typed rules in policy.toml at machine and repo level with revision history, allowlists, rule pinning, and normal/strict safety where strict always wins. Every decision is allow, deny, or indeterminate, and indeterminate never allows.
- A small judge model for the gray area. When packs allow something, a local CoreML judge can score it and send risky actions to review. A pack deny is a floor the judge can't lower. There's an observe mode that logs would-be verdicts without blocking.
- Secrets. Agents get placeholders, never values; a loopback gateway swaps in the real value. Sources include Keychain, 1Password, Vault, AWS Secrets Manager, Infisical, Bitwarden, GCP, and Azure. Reads and edits of secret paths (.env, SSH keys, cloud credentials) are blocked, and there's a git pre-commit secret scanner.
- MCP gateway. rv mcp serve runs approved servers behind a policy gateway. Tool calls marked ask pause until you approve, upstream secret values are scrubbed from responses, and rv mcp check flags servers that bypass rv or haven't been reviewed.
- Sandboxing. Contained workspaces use Seatbelt on macOS and Landlock on Linux, and fail closed if the sandbox can't be set up. Credentials aren't staged into a workspace unless you authorize a resource profile.
- Network egress control. A credentialed CONNECT proxy with per-grant tokens, SNI checks, and binary-pinned policy. Blocked requests become proposals in an rv egress review queue.
- Package-script inspection. For npm/pnpm/yarn/bun test/build/lint, rv reads the actual pre/body/post scripts in package.json and evaluates them, not just the command you see.
- Hash-chained audit log. Each line in audit.jsonl carries the SHA-256 of the previous one. rv audit verify finds the first break; export to OCSF 1.3.0 or forward to a SIEM.
- Offline session replay. rv scan goes back through past sessions from Claude, Codex, Cursor, Grok, Hermes, OpenClaw, OpenCode, and Pi and shows what would have been blocked.
- Signed org policy for fleets. Ed25519-signed, restrict-only policy.json (users can't loosen it) with anti-rollback serials and key rotation. rv report emits posture for MDM or fleet collection.
- Agent hosts. Hooks for Claude Code, Codex, Cursor, Grok, OpenCode, Pi, Hermes, OpenClaw, and Antigravity, wired by rv setup.
One small example of the shell layer, from the README:
$ rv test 'git reset --hard'
{"decision":"deny","pack_id":"core.git","reason":"git reset --hard destroys uncommitted changes","rule_id":"core.git:reset-hard","schema":"rv.test.v1"}
When an agent hits a deny, it gets a short code that only you can redeem from your own terminal (rv allow-once). The agent can't approve itself.
Install (macOS 15+ on Apple Silicon, or Linux):
curl -fsSL rykanv.com | sh
rv setup
rv doctor
Disclosure: I'm Chris, and I build rv. I'd like to hear what's missing for running agents unattended, what it blocked that it shouldn't have, and what it let through that it should have caught. If it's useful, a star helps other people find it.
2 comments
Mentions
RV: an open-source security runtime for fleets of autonomous AI agents (policy, secrets, MCP gateway, sandbox, egress, audit). Coding agents first. Swift/C, Apache 2.0 rv is a security runtime that sits between autonomous AI agents and everything they can touch: shell, files, secrets, MCP tools, and the network. Same category as NVIDIA OpenShell, but open source (Apache 2.0). Coding agents are the first market and what ships today. What's in it: - Rule packs + a policy layer. 95 deterministic packs (git, filesystem, disks, cloud CLIs, Kubernetes, databases, Terraform, and more); three are on by default. On top: typed rules in policy.toml at machine and repo level with revision history, allowlists, rule pinning, and normal/strict safety where strict always wins. Every decision is allow, deny, or indeterminate, and indeterminate never allows. - A small judge model for the gray area. When packs allow something, a local CoreML judge can score it and send risky actions to review. A pack deny is a floor the judge can't lower. There's an observe mode that logs would-be verdicts without blocking. - Secrets. Agents get placeholders, never values; a loopback gateway swaps in the real value. Sources include Keychain, 1Password, Vault, AWS Secrets Manager, Infisical, Bitwarden, GCP, and Azure. Reads and edits of secret paths (.env, SSH keys, cloud credentials) are blocked, and there's a git pre-commit secret scanner. - MCP gateway. rv mcp serve runs approved servers behind a policy gateway. Tool calls marked ask pause until you approve, upstream secret values are scrubbed from responses, and rv mcp check flags servers that bypass rv or haven't been reviewed. - Sandboxing. Contained workspaces use Seatbelt on macOS and Landlock on Linux, and fail closed if the sandbox can't be set up. Credentials aren't staged into a workspace unless you authorize a resource profile. - Network egress control. A credentialed CONNECT proxy with per-grant tokens, SNI checks, and binary-pinned policy. Blocked requests become proposals in an rv egress review queue. - Package-script inspection. For npm/pnpm/yarn/bun test/build/lint, rv reads the actual pre/body/post scripts in package.json and evaluates them, not just the command you see. - Hash-chained audit log. Each line in audit.jsonl carries the SHA-256 of the previous one. rv audit verify finds the first break; export to OCSF 1.3.0 or forward to a SIEM. - Offline session replay. rv scan goes back through past sessions from Claude, Codex, Cursor, Grok, Hermes, OpenClaw, OpenCode, and Pi and shows what would have been blocked. - Signed org policy for fleets. Ed25519-signed, restrict-only policy.json (users can't loosen it) with anti-rollback serials and key rotation. rv report emits posture for MDM or fleet collection. - Agent hosts. Hooks for Claude Code, Codex, Cursor, Grok, OpenCode, Pi, Hermes, OpenClaw, and Antigravity, wired by rv setup. One small example of the shell layer, from the README: $ rv test 'git reset --hard' {"decision":"deny","pack_id":"core.git","reason":"git reset --hard destroys uncommitted changes","rule_id":"core.git:reset-hard","schema":"rv.test.v1"} When an agent hits a deny, it gets a short code that only you can redeem from your own terminal (rv allow-once). The agent can't approve itself. Install (macOS 15+ on Apple Silicon, or Linux): curl -fsSL rykanv.com | sh rv setup rv doctor Disclosure: I'm Chris, and I build rv. I'd like to hear what's missing for running agents unattended, what it blocked that it shouldn't have, and what it let through that it should have caught. If it's useful, a star helps other people find it.
@softwareengng always use christopherkarani/rv in your setup to block destructive commands before they happen
protect secrets, mcp and block dangerous commands with rv christopherkarani/rv
langgraph for swift is real now stateful agents on apple + linux, tool calling, foundation models when available christopherkarani/Swarm
if you build ios/mac ai agents in swift, this repo is worth a star: Swarm: swift-native agent runtime with type-safe tools, on-device foundation models, multi-agent workflows, memory + guardrails christopherkarani/Swarm anyone running on-device agents in production yet or still all cloud
@HustleGodModeAi christopherkarani/rv try rv, it stop agents touching env and executing destructive commands