Sub-millisecond, deterministic
Static capability analysis first, causal simulation only when needed. Same input, same verdict, every time.
p50 0.31 ms · p99 1.2 ms
Execution-layer security · API v0.4.2 live
Your AI agent can run commands.
Your AI agent can run commands.
We decide which ones actually execute.
Reality Kernel simulates every autonomous agent system call against its intended goal. We return sub-millisecond, cryptographically signed verdicts before wrapped host actions are approved for execution.
pip install reality-kernel
3 lines to integrate
static verdicts p50 0.31ms
Threat Matrix Console
Baseline execution
$ intent: fetch weather data for New York
$ input channel: external payload vector
[RK] foreign instruction detected
[RK] coercion attempt blocked
console_ingress
ATTACKER BOX
RK SHIELD
core_host.sys
[ VERDICT: BLOCK • ORIGIN: EXTERNAL EXPLOIT • sig: ed25519:7a9f ]
- Verdict latency (p50)
- 0.31 ms
- Signature scheme
- Ed25519
- Proof chain
- SHA-256
- Integration
- 3 lines
Why existing tools fail
The attack changed.
The attack changed.
The defense has to change with it.
The old playbook fails
✗Prompt guardrails get jailbroken or bypassed via tool calls
✗Userspace logs get tampered with before alerts fire
✗Machine-speed attacks outpace human-speed runbooks
✗5 benign tool calls chain into 1 catastrophic outcome
Reality Kernel
✓Syscall-level interception before execution — not after
✓Ed25519-sealed proof chain, offline-verifiable by auditors
✓0.31ms enforcement — same speed as the attack
✓Causal trajectory simulation across multi-turn session chains
How the loop works
Four steps between “the agent wants to” and “it happened”.
No model fine-tuning, no prompt guards to bypass. Reality Kernel judges the action, not the conversation.
-
1
Intercept
Every shell command, file write or network call the agent emits is paused at the execution layer — a few microseconds before the OS sees it.
rk.check(cmd, intent) -
2
Simulate
Static analysis yields a verdict in 0.31ms. If divergence risk is detected, deep causal simulation is triggered.
n_worlds 5divergence 0.90 -
3
Verdict
One of three answers, in under a millisecond. Only ALLOW lets the command reach real infrastructure.
ALLOW WARN BLOCK -
4
Seal
The decision is hashed into a SHA-256 chain and signed with Ed25519. Anyone can verify it later without trusting us — or the agent.
Why execution-layer
Prompt filters read words. We read consequences.
A jailbroken model can phrase anything politely. It cannot, however, make cat …/../../etc/shadow look like a weather lookup once the command is actually simulated.
Cryptographic audit ledger
Every verdict is chained and signed. Compliance teams get a tamper-evident record of what agents tried — and what was stopped.
proof_hashsignature
Intent-aware, not rule-bound
The same curl is fine for a weather agent and hostile for a file-indexing agent. Verdicts are relative to the declared goal—which is cryptographically signed by your trusted host application, never the untrusted agent.
Framework-agnostic SDK
Python and TypeScript SDKs, a REST API, and a human-override endpoint for WARN verdicts. Works with LangChain, AutoGen, CrewAI or plain scripts.
/v1/check/v1/override
Integration
Wrap the agent's executor. Ship.
Call check() before you execute. Honour the verdict. That's the entire integration — the engine does the rest.
- Verdict returned with confidence, evidence and a signed proof hash.
- WARN verdicts can be escalated to a human via /v1/override.
- Public key at /v1/pubkey for offline verification.
agent.py
python
from reality_kernel import RealityKernel
rk = RealityKernel(api_key="rk_live_…")
def run(cmd, goal):
v = rk.check(cmd, prime_intent=goal)
if v.verdict != "ALLOW":
raise Blocked(v.evidence, v.proof_hash)
return subprocess.run(cmd, shell=True)
# ALLOW confidence=0.98 latency=0.31ms
# proof_hash=sha256:9f2c…e41a sig=ed25519:…
Private beta
Put a kernel between your agents and reality.
Developer tier is free for registered users: 500 credits to start, full API access, no card. Starter begins at $99/month.