Dryx is the deterministic runtime authority for AI agents. Most security tools ask you to trust their marketing. We'd rather you check ours. Each claim below names the artifact that proves it — a CI run, a signed release record, a published key — and says plainly which artifacts are public today and which ship with the first release.
The heavy analysis runs once, in CI; the receipts below are the output. Each card maps to an artifact you can check yourself. Where an artifact isn't public yet, the link points here — never to a dead URL.
50 canary secrets go through Dryx's detector cascade on every change to the redaction pipeline — every push to main and every pull request that touches the detector, the sanitizer, the fixture or the runner. Zero tags survive. Status: green in our CI. The repository is private today, so this run is not yet public; this card is the description, not the receipt.
73 per-pass test cases against the same SecretDetectorCascade the app ships — compiled with swiftc -parse-as-library, no mocks. Dryx normalizes Unicode before it looks for a secret, so a value hidden with invisible characters still gets caught. Runs in CI. Status: green in our CI. The repository is private today, so this run is not yet public; this card is the description, not the receipt.
39 per-transform test cases covering path canonicalization, schema stamping, namespace assertion, and pipeline composition. Runs in CI. Status: green in our CI. The repository is private today, so this run is not yet public; this card is the description, not the receipt.
A bypass-survey harness exercises 14 documented categories — Unicode invisibles, base64 wraps, multi-line splits, homoglyphs — against the redaction pipeline. It is run deliberately against the pipeline rather than on a schedule. A public harness you can clone and run against any tool is coming; until it ships, the categories and method are documented here.
spctl -a -vv and codesign -dv.On the direct-download build, a signed policy is verified before it is honored, the agent-side hook watches its own integrity and re-establishes itself if tampered with, and an action in a precomputed-dangerous class fails closed rather than slipping through. This is the build's behavior at the harness hook.
The honest scope: deterministic enforcement of the precomputed-dangerous set where the harness supports a hook and the machine can run the check; defense-in-depth everywhere else. It does not take all risk away. If a machine cannot run the check — a Mac with no developer tools installed, say — Dryx records that and shows it, rather than reporting protection it never performed. The Mac App Store build (Dryx Inspect) will be free, read-only inspection — Observe and Enforce ship in the direct download. How runtime authority works →
Your workspace never leaves your machine. We have no server that can see what you inspect. Verdicts run offline. A deliberately small, disclosed set of requests can leave your Mac — none of them carry your config, secrets, or findings:
None carry your workspace data. Dryx uses loopback-only IPC with no remote egress — verify with Little Snitch.
Found a security issue in Dryx? We want to hear from you.
Please include in your report:
dryx --version)Encrypted reports: A dedicated disclosure PGP key is coming. Until it's published, email [email protected] and we'll arrange a secure channel for sensitive details. Our machine-readable policy lives at /.well-known/security.txt.
Reporters of validated, in-scope, previously undisclosed vulnerabilities are recognized in our public security changelog. Cash bounties may be offered for severe findings at our discretion.
Dryx does not currently operate a public bug bounty program with predefined payouts. As we grow, we'll formalize this — and any researcher who reports a critical vulnerability before that program launches will receive priority consideration when it does.
No third-party security audit of Dryx has been performed. We'd rather state that plainly than imply one is around the corner. What you can check yourself, today: the gate Dryx deploys is readable Python at ~/.dryx/dryx-gate.py on your own machine — you can read exactly what it refuses, and the floor's stop-set is published at dryx.ai/floor.json, held equal to the gate's constants by a parity test in the gate suite and in CI; the canary suite above runs on every change to the redaction pipeline; releases are signed against a published verify key and recorded in an append-only log; and the disclosure policy is on this page. When we commission an audit, we will publish the firm, the scope, and the findings — including the ones we didn't fix.
We map every finding to the OWASP MCP Top 10 and OWASP Agentic Top 10 — named, checkable documents. As insurers and standards bodies publish AI-agent control language (CIS Controls v8.1.2's AI workbook already names local agent runtimes and MCP configuration files), Dryx's inventory and control evidence is built to answer those questions from the machine's own record.
CycloneDX AI Bill of Materials export is on the Pro roadmap.
Dryx is patent pending, earliest priority date April 16, 2026, spanning multi-party consensus, policy directive injection, adversarial request resistance, behavioral baseline, orphaned configuration detection, pre-deployment blast radius, and multi-layer enforcement. Priority date April 2026. Read the categories →
Last updated: August 30, 2026 · Version 1.3