⚡ DROS™ VajraClaw for DSH & Multi-Agent Workstations
Local Tool-Call Failsafe & Runtime Governance Sidecar for Autonomous AI Agents
English | 繁體中文說明 | 🌐 Official Website
Local tool-call failsafe for DSH: blocks high-risk shell patterns (e.g. destructive recursive deletions, fork bombs, disk overwriting) and credential-file reads before execution, with a persistent hash-linked JSONL audit log, and an optional external Gateway for centralized multi-agent policy.
🎯 Dual Architecture Overview:
- Embedded Mode (Default): Zero-dependency local TypeScript pattern-matching failsafe and JSONL audit chain running natively inside DSH with zero latency overhead.
- Gateway Mode (Optional): Connect to an external DROS Gateway container for multi-agent workstation synchronization (AGY, Codex, Claude Code, Cursor).
DSH Tool Call Event
│
▼
[dsh-plugin-vajraclaw]
│
┌──────────────┴──────────────┐
▼ ▼
[Embedded Mode] (Default) [Gateway Mode] (Optional)
• Regex Pattern Failsafe • Centralized Multi-Agent Policy
• Sensitive File Protection • Cross-Station Sync (AGY, Codex, Claude)
• Persistent JSONL Audit • Requires DROS Gateway Container
🎁 【Community Edition: Free Forever for Personal Multi-Agent Workstations】
- 🛡️ 100% Free for Personal Use (Non-Commercial Use): Embedded local failsafe is fully open-source (Apache-2.0).
- 📝 Audit Logging: Structured JSONL audit records linking execution history across session restarts.
- ⚡ Optional Centralized Gateway: Provides cross-agent governance when opting into external Gateway deployment.
📌 Compliance Notice: Any deployment operated by corporate entities, salaried employees within the scope of employment, or used to generate commercial value strictly requires a commercial license.
🏛️ Philosophy: Guarding the Hyper-Open Plugin Ecosystem
The brilliance of DeepSeek Harness (DSH) lies in its radical openness: "Everything is a plugin." However, this hyper-openness inevitably expands the attack surface:
- Any rogue third-party plugin can attempt unauthorized tool execution, memory poisoning, or silent data exfiltration.
- DROS steps in as the universal anchor, orchestrating best-of-breed open-source security tools (Falco eBPF, Cilium CNI, Wazuh SIEM) to construct an impregnable Defense-in-Depth perimeter for all developers!
┌─────────────────────────────────────────────────────────────┐
│ 1. In-App Layer: DSH Security Plugins │ <── 🏢 Reception Security (Prompt Filtering)
│ (NeMo / Llama-Guard filters conversational toxicity) │
└──────────────────────────────┬──────────────────────────────┘
│ (Valid Prompt, prepares Tool Call)
▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Runtime Gateway: DROS VajraClaw (Core Anchor) │ <── 🏛️ Vault Gatekeeper (Execution Identity)
│ (W3C DID Signature + 364ns O(1) Tool Permission Bitmap) │ Enforcement-path latency <1 μs under specified benchmark!
└──────────────────────────────┬──────────────────────────────┘
│ (Permitted Tool Call)
▼
┌─────────────────────────────────────────────────────────────┐
│ 3. Infrastructure Layer: Open-Source SecOps (Cilium / Falco)│ <── 🚓 Police Grid (Kernel & Network Fabric)
│ (Cilium blocks rogue egress; Falco eBPF catches escapes) │
└─────────────────────────────────────────────────────────────┘
🧭 Governance Scope: What DROS Defends vs. What It Doesn't
To maintain complete architectural clarity and rigorous technical defense, DROS defines crisp defensive boundaries:
| Attack Vector / Threat | Traditional Semantic Guardrails | DROS VajraClaw Core | Defensive Outcome |
|---|
| Indirect Prompt Injection (PDF/Web hijacking tool execution) | ❌ Easily fooled by LLM confusion | ✅ Deterministic Block | Deterministic In-Band Fusing (<1μs benchmarked bitmap match) |
| Rogue Tool Calling (Unauthorized DB write / Shell execution) | ❌ Flawed application logic | ✅ Cryptographic Block | 100% Interception within defined threat model & capability vector |
| Data Exfiltration (Plugin silently sending tokens to C2) | ❌ Invisible to LLMs | ✅ Network Isolated | 100% Dropped (internal: true sandbox topology) |
| Container Escape / Privilege Escalation | ❌ No host visibility | ⚠️ Handled via Falco | eBPF Kernel Detection (cap_drop: ALL capability isolation) |
| Business Logic Flaws / Model Hallucinations | ❌ Beyond security scope | ❌ Beyond security scope | Handled via Prompt engineering & Agent QA workflows |
🔑 Zero-Trust Key Management & Root Recovery Principle
DROS operates on a strict Zero-Trust Cryptographic Model:
- No Backdoors Policy: The vendor holds NO master keys. Your Ed25519 private seed hex is generated locally. Always backup your seed hex into your password manager.
- Rebuilding Root of Trust: If you lose your private key, recovery is only possible if you maintain Root/SSH access to the host server to re-deploy the public verification key.
🌐 Multi-Agent Workstation Architecture (DSH + AGY + Codex + Claude)
Although packaged as a DSH plugin for zero-friction setup, the underlying DROS Gateway runs in Docker (localhost:8080), enabling you to protect your entire multi-agent environment under a single 5-Agent Concurrent Governance Envelope:
graph TD
subgraph "Your Local Developer Workstation"
DSH[DeepSeek Harness<br/>dsh-plugin-vajraclaw] -->|HTTP / Intercept| GW[⚡ DROS Docker Gateway<br/>localhost:8080]
AGY[Google Antigravity AGY<br/>MCP / Python SDK] -->|MCP Gateway| GW
Codex[OpenAI Codex / Claude Code<br/>Tool Interception] -->|REST / C-ABI| GW
Cursor[Cursor / IDE Agents<br/>Local Hook] -->|API Proxy| GW
GW --> Micro[🛡️ DROS Micro-Kernel<br/>O 1 Bitmap Matrix & Ed25519 W3C DID]
Micro --> OS[Local OS / Filesystem / Terminal Execution]
end
💡 For the latest pricing and tiers, please visit the Official Website (dr-os.io).
| Feature / 6-Pillar Dimension | 🟢 Hacker / Community (Free) | 🔵 Startup | 🟣 Enterprise | 👑 Sovereign |
|---|
| Target Audience | Individual Devs / Local Multi-Agent | 10~50 Dev Teams | Enterprises / Listed Co. | Banking / Defense / Gov |
| Machine UUID Limit | 1 UUID | 3 UUIDs | 15 UUIDs | Unlimited |
| Concurrent Agents | 5 Concurrent Agents | 30 Agents | 450 Agents | Unlimited (Swarm) |
| Pillar 1: Principal (W3C DID) | ✅ Native W3C did:key | ✅ 3-Tier PKI DIT | ✅ Cross-Domain BEC Issuance | ✅ Hardware Dongle |
| Pillar 2: Authorization (Deterministic) | ✅ AST Bitmap Matching | ✅ Zero-Heap Bitmaps | ✅ Custom Capability Vector | ✅ Multi-Dim Bitmap Matrix |
| Pillar 3: Tool Bound (Syscall Gate) | ✅ C-ABI / HTTP Fuse (<1μs) | ✅ 26.1μs In-Band Fuse | ✅ Sub-500ns Thread Panic | ✅ Hardware Physical Fusing |
| Pillar 4: Policy Gate (Dynamic Control) | ❌ Static Rules Only | ✅ Dynamic PII Masking | ✅ HITL Multi-Sig + ZKP | ✅ Military Gate Matrix |
🚀 Quick Start (30 Seconds)
Step 1: Start the Universal DROS Docker Gateway
docker run -d -p 8080:8080 --name dros-gateway dros/hacker-gateway:v1.0.0
Step 2: Connect Your Agents
👉 📖 Read the Advanced SecOps Guide (docs/ADVANCED_SECOPS_GUIDE.md) for internal: true network isolation, Falco eBPF, and Wazuh integration templates.
📜 Technical Foundations & Benchmark Sandboxes
The deterministic runtime governance, microsecond circuit-breaking, and cryptographic audit mechanisms implemented in this project are grounded in the following academic research and open-source benchmark environments:
-
Core Architecture & Six Fundamental Boundaries:
-
Defense-in-Depth Substrate (4-Layer Model):
-
External C-ABI & Non-Repudiable Attribution (PGM):
-
Open Technical Standard & Verification Benchmark:
- RFC-010 Standard: Compliant with Open Agent Passport & Evidence Specification (W3C DID
did:key & Ed25519 signature chain).
- Benchmark Testbed: DROS-VEP Lite (Reproducible Security Sandbox)
- Empirical Report: 24-hour continuous multi-scenario soak test report (160,611 requests verified at 26.1μs decision latency).
🏛️ Official Organization & Contact Information
📄 Patent & Legal Notices
Patent Notice: DROS deterministic runtime execution governance and in-band interception technology is protected under U.S. Provisional Patent Application (U.S. PPA No. 64/111,973, Patent Pending). All commercial rights reserved by Top-Celestial Company Ltd.
🇹🇼 繁體中文說明
通用型 AI Agent 確定性運行期安全治理與微秒級熔斷微核心。原生適配 DeepSeek Harness (DSH) 外掛，同時可作為 Docker 本地 Sidecar 守護 AGY (Google Antigravity)、OpenAI Codex、Claude Code、Cursor 與 OpenClaw 等各類 Agent。
🎯 核心架構定位（一句話拆解認知）：
DSH 是 DROS 的社群入口；DROS 是跨 Agent 的執行治理層。
取得入口 (GET IT HERE)
DSH 市集外掛
│
│ 渠道分發 (distribution)
▼
DROS VajraClaw
│
部署形態 (DEPLOY IT HERE)
Docker / Sidecar
│
┌─────────────────┼─────────────────┐
▼ ▼ ▼
DSH AGY Codex ... (Claude, Cursor, OpenClaw)
│ │ │
└─────────────────┼─────────────────┘
▼
DROS 治理邊界 (Enforcement)
│
┌─────────────┼─────────────┐
▼ ▼ ▼
MCP API CLI
🎁 【個人開發者社群版：多 Agent 工作站永久免費】
- 🛡️ 個人使用（非商業用途） 100% 永久免費（為本機多 Agent 工作站建立統一安全邊界，支援最多 5 個並發 Agent）。
- 🪪 三層密碼學架構模型 (
RFC-010)：
- 主體身分 (Identity)：原生 W3C DID 金鑰綁定 (
did:key:z6Mku...)。
- 執行存證 (Evidence)：每次 Tool 執行產生 Ed25519 數位簽章。
- 不可否認追溯 (Accountability)：防篡改之本機 JSON 審計存證鏈。
- ⚡ Universal Docker 網關：同時保護 DSH 外掛、MCP 服務器與各類終端 CLI Agent。
🏛️ 核心哲學：引領開源資安陣營，守護極致開放的插件生態
DeepSeek Harness (DSH) 的偉大之處在於其極致的開放性──「一切皆插件 (Everything is a plugin)」。然而，極致的開放必然伴隨著攻擊面的無限放大：
- 第三方惡意外掛可能企圖越權讀檔、篡改全域記憶體，或暗中將數據發往外部 C2 伺服器。
- DROS 扮演了「開源資安與網管的領頭羊與核心定錨」：攜手 Falco eBPF、Cilium 網路隔離與 Wazuh 審計，為全球開發者架構起完整的立體防禦縱深，讓每位 Agent 玩家都能安心享受開源生態的自由！
┌─────────────────────────────────────────────────────────────┐
│ 1. 應用程式內部層 (In-App Layer: DSH 內部插件) │ <── 🏢 前台安檢 (Prompt Filter)
│ - NeMo / Llama-Guard: 負責對話語意審查與不良內容過濾 │
└──────────────────────────────┬──────────────────────────────┘
│ (通過語意審查，Agent 發起 Tool Call)
▼
┌─────────────────────────────────────────────────────────────┐
│ 2. 運行期治理閘道 (Runtime Gateway: DROS VajraClaw) │ <── 🏛️ 金庫守衛 (Execution Identity)
│ - W3C DID 身分指紋 + 364ns 權限點陣查表 │ 指定基準測試配置下執行路徑延遲 <1 μs！
└──────────────────────────────┬──────────────────────────────┘
│ (放行合法的 Syscall / Egress 流量)
▼
┌─────────────────────────────────────────────────────────────┐
│ 3. 基礎設施與核心層 (Infra SecOps: OpenShip / Falco / Cilium)│ <── 🚓 特警防線 (Kernel & Network Fabric)
│ - Cilium 封鎖惡意外發；Falco eBPF 核心層捕捉容器逃逸 │
└─────────────────────────────────────────────────────────────┘
🧭 治理邊界：DROS 守護什麼 vs. 不守護什麼
為了維護極致嚴謹的工程界線與防禦範疇，DROS 明確劃定邊界：
| 攻擊手法與威脅情境 | 傳統語意 Guardrails | DROS VajraClaw 物理微核心 | 最終防禦效果 |
|---|
| 間接提示詞注入 (網頁/PDF 夾帶指令詐騙 Agent 刪庫) | ❌ LLM 語意混淆易被繞過 | ✅ 確定性攔截 | 確定性帶內物理熔斷 (<1μs 基準測試點陣查表) |
| 側向越權調用 (未授權外掛偷偷呼叫 DB/付款 Tool) | ❌ 應用層邏輯脆弱 | ✅ 密碼學阻斷 | 100% 阻斷 (在定義之威脅模型與 Capability 向量內) |
| 私自外發洩密 (外掛私自連線外部 C2 傳輸機密) | ❌ LLM 完全無感 | ✅ 網路微隔離 | 100% 丟包 (internal: true 沙盒拓撲) |
| 容器逃逸與宿主機提權 | ❌ 無主機核心視角 | ⚠️ 協同 Falco eBPF | 核心層捕捉 (cap_drop: ALL 特權剝奪隔離) |
| 業務邏輯錯誤與模型幻覺 | ❌ 超出資安範疇 | ❌ 超出資安範疇 | 屬 LLM 生成品質，由 Prompt 工程與 QA 流程優化 |
🔑 零信任金鑰與 Root 救援生死警示
DROS 嚴格貫徹 零信任密碼學架構：
- 原廠無後門聲明 (No Backdoors)：原廠無任何萬用金鑰。您的 Ed25519 私鑰種子 (Seed Hex) 僅存在本地記憶體，請務必自行妥善備份至密碼庫 (1Password / Bitwarden)。
- 重建信任根 (Rebuilding Root of Trust)：若遺失私鑰，唯有在保有伺服器最高 Root / SSH 管理員權限 的前提下，方可手動替換驗證公鑰以重建信任根。
🌐 通用多 Agent 混合工作站拓撲 (DSH + AGY + Codex + Claude)
DROS 雖以 DSH 外掛形式提供一鍵安裝，但底層是 標準化 Docker 容器 (localhost:8080)，單台開發機可同時守護多個不同平台的活躍 Agent（共用 5 個並發配額）：
- DSH 使用者 ➔ 透過
dsh-plugin-vajraclaw 接入。
- Google Antigravity (AGY) ➔ 透過 MCP 網關或 Python SDK 接入。
- OpenAI Codex / Claude Code / Cursor ➔ 透過本地 REST API / Hook 攔截接入。
💡 最新定價與方案請以 官方網站 (dr-os.io) 公布為準。
| 安全功能 / 6-Pillar 機制維度 | 🟢 Hacker / 個人社群版 (免費) | 🔵 Startup | 🟣 Enterprise | 👑 Sovereign |
|---|
| 目標客戶 | 個人開發者 / 本機多 Agent 玩家 | 10~50人新創團隊 | 中大型企業 / 上市公司 | 金融金控 / 國防 |
| 機器授權 (UUIDs) | 1 組 UUID | 3 組 UUIDs | 15 組 UUIDs | 無限制 |
| Concurrent Agents 上限 | 5 個並發 Agent | 30 個 | 450 個 | 無限制 (Swarm) |
| Pillar 1：Principal 身份證明 | ✅ 原生 W3C did:key 指紋 | ✅ 3-Tier PKI DIT | ✅ 跨域 BEC 憑證發放 | ✅ 硬體 Dongle 印記 |
| Pillar 2：Authorization 權限區隔 | ✅ AST 點陣圖比對 | ✅ 零堆積 Bitmaps | ✅ 全自訂 Capability 向量 | ✅ 動態位元圖多維矩陣 |
| Pillar 3：Tool Bound 工具邊界 | ✅ C-ABI / HTTP 熔斷 (<1μs) | ✅ 26.1μs 帶內熔斷 | ✅ Sub-500ns Thread Panic | ✅ 晶片硬體級物理熔斷 |
| Pillar 4：Policy Gate 三大門閥 | ❌ 僅靜態規則 | ✅ 動態 PII 遮蔽 | ✅ HITL 雙簽 + ZKP-Lite | ✅ 軍規級門閥矩陣 |
| Pillar 5：Audit Log 稽核追溯 | ✅ Ed25519 簽章日誌 | ✅ |
🚀 30 秒極速上手
步驟 1：啟動 DROS Docker 網關
docker run -d -p 8080:8080 --name dros-gateway dros/hacker-gateway:v1.0.0
步驟 2：連接您的 Agent
👉 📖 閱讀進階資安與多 Agent 拓撲加固手冊 (docs/ADVANCED_SECOPS_GUIDE.md)（獲取 internal: true 網路微隔離 Compose 範本、Falco eBPF 核心防逃逸與 Wazuh SIEM 整合指南）。
📜 相關技術核心論文與實測驗證 (Technical Foundations & Benchmarks)
本專案之確定性執行治理、微秒級熔斷與密碼學存證機制，參考並延伸自以下核心技術論文與開源實測環境：
-
核心架構與六大信任邊界 (Core Architecture):
-
四層深度防禦架構 (Defense-in-Depth Model):
-
外掛 FFI 與不可否認存證模組 (Runtime Attribution Framework):
-
開源技術標準與實測基準倉 (Open Standard & Verification Sandbox):
- RFC-010 規範: 遵循開放 Agent 身分與存證規範（W3C DID
did:key 與 Ed25519 簽章鏈）。
- 實測基準環境: DROS-VEP Lite (可復現安全評測沙盒)
- 實測報告: 涵蓋 24 小時長效多場景測試數據（160,611 次請求驗證，決策延遲 26.1μs）。
🏛️ 官方發行組織與聯繫資訊 (Official Contact)
📄 專利與法律聲明
專利聲明： DROS 執行治理與安全技術已申請美國臨時專利保護（U.S. Provisional Patent Application No. 64/111,973，Patent Pending）。
