A
licenseB
qualityA
maintenanceA governance proxy for AI tools — every MCP/agent tool call is policy-gated, secret-redacted, and written to a hash-chained, offline-verifiable audit trail.
13
MIT
DROS-VajraClaw
Deterministic in-band execution governance gateway that evaluates agent actions against capability policies in sub-microsecond latency.
Evaluate actions: Call
dros_evaluatewith acapabilitystring to get a deterministic allow/deny verdict.Pass contextual inputs: Supply optional
parameters(object) for action-specific evaluation data.Enforce compile-time policy gates: Verification runs as a C-ABI/Rust core bitmap check (~<3 µs), not prompt-based guardrails.
Govern multi-agent harnesses: Proxy model/agent traffic through the local Docker loopback gateway (~<1 ms HTTP/IPC latency).
Integrate with MCP clients: Connect Claude, Cursor, Codex, or Antigravity via
http://localhost:8080/mcp(HTTP transport).Run locally for free: Non-commercial/personal evaluation is license-free; commercial production use requires a license.
Governs CrewAI multi-agent swarms by assigning W3C DIDs to agent roles and enforcing fine-grained capability policies across the crew.
Wraps LangChain tools with the VajraClaw runtime to enforce DROS security policies on agent actions, preventing destructive commands and unauthorized tool executions.
Enables policy-based governance of OpenAI SDK and Codex agent actions by evaluating tool calls against VajraClaw security policy before execution, blocking unauthorized operations with an audit trail.
🛡️ Deterministic Runtime OS (DROS) - VajraClaw Hacker Edition
The Deterministic In-Band Execution Governance Gateway for Autonomous Agentic AI
📖 Documentation / 語言選擇: English (Default) | 繁體中文文檔 (Traditional Chinese)
🛑 "If runtime security depends on model intelligence, the system is already broken."
Prompt engineering and guardrails fail under adaptive adversarial jailbreaks. DROS is NOT a prompt wrapper. It is an In-Band Execution Governance Gateway. By moving verification to compile-time capabilities, DROS enforces deterministic policy gates at runtime:
In-Process C-ABI / Rust Core: $< 3\ \mu\text{s}$ deterministic capability bitmap evaluation (zero-heap, in-memory bitmasking).
Docker Loopback Gateway: $< 1\ \text{ms}$ local HTTP/IPC proxy latency for multi-agent harness environments.
📚 Official Documentation Navigation
Document | Language | Description |
English | Detailed product overview, benchmarks, and licensing terms | |
繁體中文 | 完整產品架構、微秒級熔斷原理與個人免費版中文說明 | |
EN / 繁中 | Ethical boundaries, GuardVM sandbox policy, and scope limits | |
English | Zero-dependency local CLI verification, diagnostics, and testing | |
Bilingual | Ephemeral keys, static key backup, and disaster recovery SOP | |
English | Dual-perspective mechanics and Vajra policy authoring guide |
Related MCP server: Sentinel Gateway
🚀 Quick Start (Docker Loopback Gateway)
Run the pre-built gateway container locally (no API key required for local evaluation):
docker run -d -p 8080:8080 --name dros-gateway \
-v $(pwd)/FreeTrial-Sandbox/demo_policy.yaml:/app/demo_policy.yaml \
dros/hacker-gateway:v2.1.0Connect with MCP Clients (Claude, Cursor, Codex, Antigravity)
Add DROS Gateway to your client configuration (mcp_settings.json):
{
"mcpServers": {
"dros-governance": {
"url": "http://localhost:8080/mcp",
"transport": "http"
}
}
}⚖️ Licensing & Intellectual Property
DROS VajraClaw Hacker Edition is proprietary software provided under a personal, non-commercial free license.
Personal Use: Free
Non-Commercial Research & Evaluation: Free
Commercial / Enterprise Production Use: Requires a commercial license (dr-os.io)
Open Source / OSI License: Not Granted (Not Apache-2.0, Not AGPL)
🛡️ Patent Notice
DROS execution governance and security technology is protected under:
U.S. Provisional Patent Application No. 64/111,973 (Patent Pending)
(A provisional patent application establishes priority and is not a granted patent.)
Top-Celestial Company Ltd. (康宸園有限公司) ── Commercial inquiries: service@dr-os.io
Available Tools
1 tooldros_evaluateC
Deterministic in-band execution guardrail evaluating actions in sub-microsecond latency.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| capability | Yes | ||
| parameters | No |
TDQS
C2/5.0
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions 'deterministic' and 'sub-microsecond latency', which are useful behavioral traits, but it does not explain side effects, whether the tool blocks/allows execution, return values, or failure modes. The key behavior—what happens with the evaluation result—is left unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness3/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundancy—it is concise in the sense of being short. However, it under-specifies the tool so severely that the brevity is more a symptom of incompleteness than effective conciseness. It is not bloated, but it doesn't earn its place as a useful summary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description must carry a heavy burden. It gives only a vague functional hint and a couple of non-functional attributes, but fails to describe inputs, outputs, side effects, or evaluation semantics. The tool is not adequately contextualized for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters1/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain or even mention the parameters 'capability' or 'parameters'. There is no indication of what values 'capability' accepts or what structure 'parameters' should follow. The description adds no meaning beyond the bare schema, leaving the agent unable to construct a valid invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose2/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses vague, jargon-heavy language ('in-band execution guardrail', 'evaluating actions') without clarifying concretely what the tool does. The verb 'evaluating' and resource 'actions' are generic, and the purpose remains ambiguous—it is not obvious what action is evaluated, how, or for what decision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool. With no sibling tools listed, there are no alternatives to contrast against, but the description also lacks any context about the intended invocation scenario or prerequisites. The agent is left to infer usage entirely from the tool name and vague description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.1.0- First observed
dros_evaluate
TDQS
C2.9/5.0
Scored across 1 tool
Disambiguation5/5
With only one tool, there is no possibility of confusion between tools. The purpose is clearly defined as a deterministic execution guardrail.
Naming Consistency5/5
The single tool name 'dros_evaluate' uses a clear verb_noun style. With only one tool, naming consistency is trivially satisfied.
Tool Count5/5
The server has a narrowly scoped purpose, acting as a single guardrail evaluation function. One tool fully serves that purpose without unnecessary extras.
Completeness5/5
For its stated domain of evaluating actions as a guardrail, the single tool covers the necessary functionality completely. There are no obvious missing operations within this narrow scope.
Maintenance
ActivityMaintained
ResponsivenessUnresponsive
Related MCP Connectors
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
- gatewayOAuthai.sealgate
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
Blockchain SSN for AI agents. MCP gateway that blocks at the point of action, tamper evident audit.
Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.
Related MCP Servers
- AlicenseBqualityCmaintenanceMCP zero-trust gateway that sits in front of every internal MCP server, detects tool-poisoning/metadata drift in real time, and maintains a cryptographic provenance ledger of every agent tool call.201 npmISC
evav-gatewayofficial
AlicenseNot gradedqualityBmaintenanceGoverned MCP gateway that lets AI agents call tools with policy enforcement, prompt-injection screening, a kill-switch, and tamper-evident signed audit logs.Apache 2.0- AlicenseNot gradedqualityAmaintenanceEnables AI agents and MCP clients to screen proposed actions, enforce deterministic policies and limits, and produce tamper-proof signed audit receipts before any external side effect is executed.0MIT