01
Describe the action
Every request names the actor, operation, parameters, risk, and intended blast radius.
W Warrant · verified actuation
A proof boundary for
agents that act.
Warrant models how allowed operations compose, searches for reachable forbidden states, and refuses execution when evidence no longer matches the verified boundary.
Install Warrant
brew install cerebral-systems/tap/warrant Bounded verification over an operator-reviewed model. Unknown or incomplete strict-mode evidence is denied.
Destructive tool calls completing
600 scripted attacks · ObservedHarm@Exec · same harness, gate off vs on
gate off
600 / 600
warrant on
318 / 600
282 held for human approval · 0 safe plans blocked · arXiv:2606.18356
All numbers & provenance →Tool-poisoning attack success
45 MCP servers · 28,639 valid cases · replay of 23 agent models
gate off
32.7%
warrant on
22.7%
FileSystem server: 41% → 6.3% · the paper’s ASR formula · arXiv:2508.14925
All numbers & provenance →MCP rug-pulls reaching infrastructure
16 tool-swap attacks + 5 benign controls · internal suite
before fix
13 / 16
after fix
0 / 16
Benign calls 5/5 in both runs · tool integrity re-verified before every call
All numbers & provenance → PROPOSED ACTION github.dispatch_workflow
HIGH RISK agent dispatch release initial state
workflow acquire db_admin grant discovered
forbidden state database.deleted reachable at depth 2
COUNTEREXAMPLE PATH 2 TRANSITIONS
01 github.dispatch_workflow → capability.db_admin 02 postgres.drop_database → database.deleted VERDICTExecution blocked
Declared-state reachability Proof-to-runtime binding Fail-closed execution fence Tamper-evident audit
Closer to formal verification Security is a state machine,
Security is a state machine,
not a string match.
Warrant compiles grants, workflows, and tools into one typed transition model, then searches it for paths into states your system must never reach—and returns the counterexample path, not a confidence score.
02
Explore the model
The checker follows declared grants, revocations, effects, and approval paths to find forbidden reachable states.
03
Bind the evidence
The report commits to the policy, catalog, verifier, actuator configuration, and observed MCP surface.
04
Act—or stop
Only a current allow or authenticated approval crosses the execution fence. Drift fails closed.
Maps every transition
Direct commands, workflows, OAuth grants, and MCP tools enter one typed transition model—the checker explores what they can compose into and returns the unsafe path for review.
Rechecks the live boundary
Policy, catalog, actuator, and MCP inventory drift invalidates strict evidence before dispatch. A tool cannot quietly change its advertised shape underneath a verdict.
Makes execution accountable
Approval, leases, idempotency, outcomes, and audit transitions stay bound to the proposal. Ambiguous side effects become explicit—not accidental success.
Measured, not promised We publish what Warrant stops.
We publish what Warrant stops.
And what it doesn't.
We run Warrant against published agent-security benchmarks and adversarial suites. Every chart compares the same harness and the same cases with the gate off versus on; a destructive call counts as blocked when Warrant denies it or holds it for human approval.
malicious code executions completing in the sandbox
SafeClawBench · exec endpointattack success on destructive filesystem calls
MCPTox · FileSystem serverMCP rug-pulls reaching live infrastructure
internal drift suiteSafeClawBench arXiv:2606.18356 harm completion 100% → 53% · gated destructive ops → 0
600 scripted attacks that end in a real destructive tool call—code execution, database writes, outbound email, file mutation. With Warrant as the pre-execution gate, harm completion falls from 100% to 53%: 282 of 600 destructive calls are held for approval before touching the sandbox, and zero safe plans were blocked in the same run.
The split is the honest part: operations the policy gates as sensitive go to zero. File and memory writes the agent was legitimately granted pass through—a capability gate cannot judge the value of an in-policy call, and we don't pretend otherwise.
SafeClawBench ObservedHarm@Exec, deterministic scripted endpoint · 600 attacks + safe plans, same run · Warrant as pre-execution tool gate, policies derived per case from the legitimate tool surface only · blocked = held for approval (282/600, zero denied safe plans) · run 2026-07-13 on our benchmark box. The benchmark's safe plans are refusal-style, so the benign axis is weaker than a production workload.
MCPTox arXiv:2508.14925 pooled ASR 32.7% → 22.7% · FileSystem 41% → 6.3%
MCPTox poisons real MCP tool descriptions and records which attacks 23 agent models actually fell for. We replayed every successful attack call across all 45 servers through Warrant—same dataset, same attack-success formula, only the gate added. Pooled attack success drops from 32.7% to 22.7% (27.0% counting hard denies only); on the FileSystem server's destructive read/write/move calls, from 41% to 6.3%.
Strongest where the poisoned tool requests an operation the task never needed; weakest where the attack only tampers with parameter values of an in-policy call. The replay also surfaced a real Warrant gap—list-valued parameters bypassed constraint checks—since fixed on master with element-wise validation.
Replay of recorded attack calls from 23 agent models · 45 servers, 28,639 valid cases · ASR = Success ÷ (total − None), the benchmark's formula · blocked = 2,855 (1,616 denied, 1,239 held for approval; split reported so approval friction isn't hidden) · policies authored from benign task semantics before viewing attacks.
MCP rug-pulls internal suite reaching infra 13/16 → 0/16 · benign 5/5
A rug-pull is an MCP server that swaps a tool's schema or behaviour after you approved it. We red-teamed Warrant with 16 runtime tool-swap attacks against a live MCP server plus 5 benign controls—found a real gap, fixed it, and re-ran the same suite. The fix re-verifies tool integrity before every call and ships on master.
After the fix, 15 of 16 attacks fail the live tool-integrity re-check and one is stopped by the capability allowlist—with no benign regression.
Internal deterministic suite, not a published benchmark · real MCP actuator over stdio against a mock server whose tool definition mutates at runtime · reached-infrastructure measured from the server's delivered-log · 16 attacks + 5 benign controls, same suite both runs · run 2026-07-13.
Warrant by Cerebral Systems Let agents move fast.