Dryx is the deterministic runtime authority for AI agents. Most security tools ask you to trust their marketing. We'd rather you check ours. Each claim below names the artifact that proves it — a CI run, a signed release record, a published key — and says plainly which artifacts are public today and which ship with the first release.
The heavy analysis runs once, in CI; the receipts below are the output. Each card maps to an artifact you can check yourself. Where an artifact isn't public yet, the link points here — never to a dead URL.
50 canary secrets go through Dryx's detector cascade on every change to the redaction pipeline — every push to main and every pull request that touches the detector, the sanitizer, the fixture or the runner. Zero tags survive. Status: green in our CI. The repository is private today, so this run is not yet public; this card is the description, not the receipt.
73 per-pass test cases against the same SecretDetectorCascade the app ships — compiled with swiftc -parse-as-library, no mocks. Dryx normalizes Unicode before it looks for a secret, so a value hidden with invisible characters still gets caught. Runs in CI. Status: green in our CI. The repository is private today, so this run is not yet public; this card is the description, not the receipt.
39 per-transform test cases covering path canonicalization, schema stamping, namespace assertion, and pipeline composition. Runs in CI. Status: green in our CI. The repository is private today, so this run is not yet public; this card is the description, not the receipt.
A bypass-survey harness exercises 14 documented categories — Unicode invisibles, base64 wraps, multi-line splits, homoglyphs — against the redaction pipeline. It is run deliberately against the pipeline rather than on a schedule. A public harness you can clone and run against any tool is coming; until it ships, the categories and method are documented here.
spctl -a -vv and codesign -dv.On the direct-download build, a signed policy is verified before it is honored, the agent-side hook watches its own integrity (on Claude Code it re-establishes itself; on Cursor and Codex it tells you), and an action in a precomputed-dangerous class is refused, and the gate records the refusal. This is the build's behavior at the harness hook.
The honest scope: deterministic enforcement of the precomputed-dangerous set where the harness supports a hook and the machine can run the check; defense-in-depth everywhere else. It does not take all risk away. If a machine cannot run the check — a Mac with no developer tools installed, say — Dryx records that and shows it, rather than reporting protection it never performed. The Mac App Store build (Dryx Inspect) will be free, read-only inspection — Observe and Enforce ship in the direct download. How runtime authority works →
For each AI coding tool Dryx knows on a Mac, three separate things, each a yes or a no. Detected. Dryx's inspection reads the tool's configuration on the Mac and maps it. Registered. Dryx registers its answer service, the Authority Anchor, into the tool's own server list, at your request. Gated. Dryx writes a hook entry into the tool's own hooks file; which actions the hook reaches is in the full card.
| Tool | Detected | Registered | Gated |
|---|---|---|---|
| Claude Code | yes | yes | yes |
| Claude Code inside the Claude desktop appCode mode shares the Claude Code hook surface, so this row follows the Claude Code row; the desktop app's own chat is not this row. | yes | yes | yes |
| Codex (CLI and desktop app) | yes | yes | yes |
| Cursor | yes | yes | yes |
| Devin Desktop (Windsurf) | yes | yes | no |
| Cline | yes | yes | no |
| VS Code | yes | no | no |
| Gemini CLI | yes | no | no |
| OpenClaw | yes | no | no |
| Ollama | yes | no | no |
| LM Studio | yes | no | no |
| Aider | yes | no | no |
| Continue | yes | yes | no |
| GitHub Copilot | yes | yes | no |
| Google Antigravity | no | yes | no |
Dryx writes a hook entry into Claude Code, Codex and Cursor today. On Codex the entry waits for your approval in Codex's own trust flow.
Where a Mac has no usable Python interpreter the gate cannot run, nothing is gated on Claude Code, Codex or Cursor, and Dryx records that and shows gate cannot run, never green.
The destructive floor the gate refuses before any policy is read is sixteen shapes, published at dryx.ai/floor.json and held equal to the shipped gate by a parity check.
Dryx checks this on your own Mac. In the app, Action Guard's runtime gate line shows the state of each of the three hooks on this Mac and Test Guard drives the deployed gate; the Verify button, which prints the gate's fingerprint beside the one this build ships, comes with the in-app coverage card.
The full coverage card is available on request. Write to [email protected]. This table is rendered from dryx.ai/coverage.json, generated 2026-10-15; a parity check in the coverage suite and in CI regenerates that file from the shipped code and fails on any drift.
Your workspace stays on your Mac. We have no server that can see what you inspect. Verdicts run offline. A deliberately small, disclosed set of requests can leave your Mac, listed below; findings leave through a webhook you configure or through your own agent's context:
Dryx's own IPC listens on 127.0.0.1, the loopback address, so the connection itself never leaves your Mac; during an inspection Dryx may also send short requests to local ports on 127.0.0.1. Verify it with Little Snitch or lsof.
Found a security issue in Dryx? We want to hear from you.
Please include in your report:
dryx --version)Encrypted reports: A dedicated disclosure PGP key is coming. Until it's published, email [email protected] and we'll arrange a secure channel for sensitive details. Our machine-readable policy lives at /.well-known/security.txt.
Reporters of validated, in-scope, previously undisclosed vulnerabilities are recognized in our public security changelog. Cash bounties may be offered for severe findings at our discretion.
Dryx does not currently operate a public bug bounty program with predefined payouts. As we grow, we'll formalize this — and any researcher who reports a critical vulnerability before that program launches will receive priority consideration when it does.
No third-party security audit of Dryx has been performed. We'd rather state that plainly than imply one is around the corner. What you can check yourself, today: the gate Dryx deploys runs on your own machine, and its published floor, at dryx.ai/floor.json, is compared to the shipped gate by a check you can run yourself and held equal to the gate's constants by a parity test in the gate suite and in CI; the canary suite above runs on every change to the redaction pipeline; the verify key for Dryx's releases is published at releases.dryx.ai/pubkey.txt; and the disclosure policy is on this page. When we commission an audit, we will publish the firm, the scope, and the findings — including the ones we didn't fix.
We map every finding to the OWASP MCP Top 10 and OWASP Agentic Top 10 — named, checkable documents. As insurers and standards bodies publish AI-agent control language (CIS Controls v8.1.2's AI workbook already names local agent runtimes and MCP configuration files), Dryx's inventory and control evidence is built to answer those questions from the machine's own record.
CycloneDX AI Bill of Materials export is on the Pro roadmap.
Dryx is patent pending · U.S. filings since April 2026. Read the categories →
Last updated: October 15, 2026 · Version 1.4