Let the agent work. Keep control of the final effect.

Who it is for

Three surfaces, one principle

Agents can propose. Authority stays outside the agent. Coverage is limited to the declared and tested routes: SecureStamp does not control operations that bypass that boundary, and it names them instead of hiding them.

Break the Mandate — the walkthrough

The entry question is simple: can your agent do something outside the task you approved? The reference scenario answers in five steps, on synthetic fixtures, with no account and no model API key.

1. 01

   A useful task

   The agent prepares a real change inside a contained fixture.

2. 02

   The gap, in the baseline

   The same out-of-scope attempt causes its effect in a deliberately permissive baseline, observed from another process. It is a known experimental control, not a vulnerability discovered on your machine.

3. 03

   The gap, contained

   With the control active that route is contained, and the useful task still completes. A denial that makes the task useless does not count as value.

4. 04

   Evidence expires when the environment changes

   A material dependency of the profile changes: the earlier evidence stops enabling that route until it is revalidated.

5. 05

   Only the exact candidate leaves

   The frozen candidate is reviewed. Altering its bytes or its destination invalidates the export; restoring what was approved allows the effect.

Quick start

Doctor needs neither Docker nor a model and executes nothing it reads. The reference scenario is synthetic: it never executes project code and its report is labeled as simulated evidence.

# Node 22.22.3 or later
npm install --save-dev @securestamp/mcp-guard @securestamp/execution-governance

# 1. Doctor: static diagnosis of the files you choose
npx securestamp-mcp-doctor scan .mcp.json --propose
npx securestamp-mcp-doctor scan-native <settings.json|config.toml> --format=<shape>
npx securestamp-mcp-doctor scan-workflow .github/workflows/agent.yml

# 2. Portable scenario: validate and run the reference, with a hold
npx securestamp-execution-governance validate scenario.json
npx securestamp-execution-governance run scenario.json --hold-before=step-1

Every command prints its usage and supported formats when given invalid arguments. For a complete HarnessProfileV1, use securestamp-mcp-doctor scan-harness. With --hold-before, the run shows a held effect that is never admitted. No telemetry by default.

Doctor: your native files first

Doctor produces declared facts, each with its source file and field, and a partial diagnosis that says which layers it read and which remain unknown. Compatibility is described as shape + transport + tested client; a format it does not recognize is reported as unsupported, never silently skipped.

• .mcp.json · JSON with mcpServers (stdio)

  Declared commands, credential references, secrets written into the file, shell launches and mutable or @latest packages. A pinned version does not establish integrity: checking the effective artifact against the approved one is the executor's job.

• settings.json · config.toml ([mcp_servers])

  Permissions, tools and recognized configuration layers, with conflicts and missing data. A single file does not reveal managed policies, CLI overrides or inherited configuration: the output says so.

• .github/workflows/*.yml

  Agent Workflow Doctor: untrusted issue, PR or comment input reaching the agent, declared permissions, secret references, broad tools and checkout of external content. It does not download actions, resolve secrets or execute YAML.

• HarnessProfileV1

  The complete profile for advanced users. Doctor never invents it from a single file: mounts, observer, effective credentials and backend are chosen and validated by the operator.

• Reads only the files it is pointed at; it does not crawl the home directory.
• Executes no commands, hooks or expressions from the file.
• Resolves no secrets and validates no tokens.
• Proposes a reviewable patch on a copy; never overwrites the original.
• Shows a clean result with the same weight as a finding.
• A static diagnosis establishes neither isolation nor protection.

Exact Export: the agent prepares, you authorize the exact change

The agent prepares the change in a contained copy of your project. The export credential stays outside its environment, and only the reviewed candidate leaves, through the Execution Guardian.

1. 01

   Prepare

   In quarantine, on a snapshot of the chosen project; your .git is never reused as a trusted base.

2. 02

   Freeze

   The candidate is fixed before review: base, bytes and digests, ref, destination and prior state.

3. 03

   Authorize

   Approval is bound to that candidate. A later change invalidates it; a --yes does not replace MFA or quorum.

4. 04

   Execute

   Held in custody by the Guardian, with a check of the destination's state: drift and races are never overwritten.

5. 05

   Verify

   Independent verification of the postcondition and a receipt you attach to the PR or issue.

The initial destination is a local Git repository. With an authorized profile and destination, the GitHub adapter creates a new ref: it does not update any branch, force-push, merge or deploy, and opening a PR is a separate effect with its own authorization. Credential custody is claimed only for the profile that demonstrates it with effective identity, mounts, sockets and network plus canaries from the agent's context.

One portable configuration, three interfaces

The configuration is a JSON file versioned in your repository. The library generates the complete contracts and their digests; nobody writes signatures by hand. CLI and dashboard import and export the same representation and pass the same validation: there is no web policy that differs from the policy in Git. Every edit creates a new revision and active runs keep their snapshot.

• npm · @securestamp/execution-governance

  Portable scenario contracts, a control plane with hold, resume and stop, and redacted reports: validate and serialize scenarios, start runs, issue idempotent orders, and build, verify and compare reports. It grants no authority, does not contain the host and does not replace the customer's Guardian.

• CLI · securestamp-mcp-doctor · securestamp-execution-governance

  scan, scan-native, scan-workflow and scan-harness for diagnosis; validate and run for scenarios. No account. Every run produces its own report without overwriting another.

• Dashboard · securestamp.online/dashboard/agents

  Scenarios, preparation, runs, live detail and post-run analysis, on enrolled runners operated by the customer. The browser does not run the test or receive provider credentials; connecting a runner is opt-in.

Hold, resume, stop

The controls act on the routes mediated by the Guardian. The agent may keep reasoning while its effects are held; the interface shows it as “effects held / process running”, never as a frozen agent.

A successful HTTP response only confirms the order was received. The dashboard shows what was requested, what the supervisor applied and what was observed, separately. If the remote channel drops while the observer is healthy, admissions stay held locally; if the observer fails, the profile cuts egress and terminates the container. The local stop never depends on the dashboard.

Reports: states that do not collapse into a traffic light

The execution report carries an informational checksum, declares its evidence level and lets runs be compared; a checksum is not issuer authentication. When a complete Action Proof bundle is attached, the standalone verifier checks it offline against trust anchors supplied outside the report and binds the exact candidate, destination, authority and observed receipt result. A FAIL, a SKIP, missing evidence or an unevaluated route stays visible; an instrumentation failure leaves the run INCOMPLETE, never PASS.

Informational pull request check

Compares base and head of the native files with the same importers and rules, shows declared changes, unknowns and candidates for revalidation, and validates an attached receipt against its anchors. It runs from a pinned trusted revision, with read permissions, no secrets and without executing code from the PR. It informs the review: it is not the check that authorizes an export, nor a substitute for the Guardian or a ruleset.

What this does not do

• It does not make the model safe or prove general alignment: it tests execution limits on a declared profile.
• It does not control routes that bypass the Guardian; a route without a probe stays not evaluated, never protected by inheritance.
• It does not undo an effect that already happened: hold and stop are not rollback.
• A receipt shows integrity and scope under its anchors; it does not show the approved code is benign or that anyone independent audited it.
• It is not a company-wide kill switch: v1 controls the chosen run and its declared runners.
• Compatibility is published per profile, version and environment. A PASS on one harness does not transfer to another operating system, route or client.

Keep reading