Skip to main content
Alpha · v0.0.0 · not production security software

Circinus

Authority has a radius.

A local-first Agent Trust Runtime for Claude Code. When a coding agent reads an issue, a web page, a changelog, or a teammate's pasted log, that content is untrusted input — but a few hops later a privileged action can get taken on authority the content was never granted. Circinus tracks that authority across the hops and decides at the point of action, so transformation never silently expands what a piece of content is allowed to cause.

Try / install Circinus

What Circinus actually does

  • Untrusted content does not gain instruction authority just because an agent repeated or summarized it.
  • Provenance and authority persist across transformations — summarizing, storing, or re-reading content doesn't launder where it came from.
  • Semantic analysis of what an agent has ingested can run ahead of time, before any sensitive action is attempted.
  • Final enforcement of an action stays local and fast — a decision at the boundary is a local read, not a network round trip.

Who it's for

Developers running Claude Code who want visibility into what an agent session would do with untrusted content before granting it the ability to actually do it — without adding a confirmation prompt for every single tool call. Circinus is scoped to Claude Code only in this MVP; it is not a general agent-framework product yet.

How this differs from generic prompt filtering

A prompt filter inspects text once, at the moment it arrives, and forgets it. Circinus instead keeps a record of where an artifact came from and what it has influenced, so a decision at the action boundary — write this file, run this command, open this PR — can be made against that lineage, not just against the argument in isolation. See the architecture summary in the docs for the actual mechanism.

Alpha status and limitations

Circinus is an experimental MVP (v0.0.0), not production security software. It starts in shadow mode by default — it observes and records what it would have done (Would-Allow, Would-Review, Would-Block) without changing the outcome of a single action; enforcement is opt-in. It does not claim prompt-injection immunity, enterprise readiness, support for agent frameworks beyond Claude Code, or proven product-market fit. Full details are on the docs limitations section.

Curious what's being considered next? See the roadmap — none of it is built yet, and none of it changes what today's install does.