Defense in depth.

Blocks loopback, RFC1918, link-local, CGNAT, and metadata IPs. Per-hop redirect validation with a configured hop limit helps reduce DNS rebinding and open-redirect abuse.

Pattern-based checks cover phrases such as ignore_previous, disregard_above, you_are_now and system_prompt_leak. Untrusted content can be wrapped with boundary markers before it enters the LLM context.

config.toml, memory.db, bible.md, safety.md, secrets.toml, .env, and credentials are blocked from agent modification. Critical configuration is read-only at the tool level.

API keys (sk-, AKIA, ghp_, xoxb-, Bearer tokens, PEM blocks) are detected and blocked before they can reach the memory store or be exposed in tool outputs.

Pattern checks can block rm -rf /, mkfs, fork bombs, dd of=/dev, chmod -R 777 /, and other catastrophic shell commands before they reach the executor.

Repeated tool-call patterns can trigger warnings or stops according to configured thresholds, helping operators review runaway behavior before side effects accumulate.

An append-only JSONL ledger can record typed verification receipts, giving operators an audit trail to inspect alongside failures and approvals.

Bearer token or X-Api-Key header required for non-loopback binding. Authentication is mandatory when the server is exposed beyond localhost — no accidental public APIs.

A sliding-window policy can limit requests per authenticated principal and return 429 with Retry-After headers when the configured limit is exceeded.

Configured response-size and text-length limits, together with per-hop SSRF checks on redirects, help reduce memory exhaustion and internal-network exfiltration.

save_contacts, git_push, and other side-effect tools require explicit human approval before execution. The agent requests, the operator decides.

Permissive CORS only when API authentication is enabled. With auth disabled, CORS is restricted to prevent unauthorized cross-origin access to the agent API.