Soup Wall v0.4.0 — Agent, Gateway, Console

Soup Wall v0.4.0 — one open-source home

This release brings the Agent, Gateway, and self-hosted Console into the public Apache-2.0 Soup Wall repository. The Gateway and Console are published as a reviewed source snapshot; the former private repository's Git history and unrelated research assets are not part of this release.

What's included

• Agent: local Claude Code hooks, MCP manifest checks, action policy, audit and replay, and Linux guarded execution.
• Gateway: OpenAI Chat Completions and Responses plus Anthropic Messages proxying, request and response inspection, bounded streaming, policy, and audit.
• Console: self-hosted tenant and token management, operator and customer browser pages, OIDC/SAML and a constrained SCIM subset, policy delivery, usage evidence, and read-only invoice previews.
• Source, deployment templates, operations and upgrade guides, platform archives, checksums, package SBOMs, and a Gateway container image.

Existing installations

The llm-firewall executable, LLM_FW_* settings, HTTP headers, token prefixes, database identifiers, and cryptographic labels keep their existing names for compatibility. Release archives also include a soup-wall-gateway executable alias. Read the upgrade guide and test your own configuration before replacing a deployed version.

v0.4.0 is the Soup Wall release tag. The individual Cargo crates retain their existing 0.1–0.3 package versions in this release; use the Git tag and archive names to identify the complete product release.

Security boundaries

The Agent starts in shadow mode, and its Claude Code hook fails open if the daemon is unavailable. Gateway agent and capability controls are opt-in. Local identity fixtures do not prove integration with a real customer IdP; usage evidence and invoice previews are not final billing. Windows token and audit file ACL hardening remains open. The documented RSA advisory exception applies only to a SAML decryption path that this product does not enable; all other advisories remain blocking.

See the security policy, roadmap, provenance, and NOTICE. Soup Wall retains attribution to Arthur Lin and contributors of the upstream carbon-evolution/llm-firewall project.

v0.3.0

First published release of Soup Wall.

Tagged at the version of agentfw, the binary this repository exists to ship. The crates in
this tag are soup-wall-core 0.2.0, soup-wall-agent 0.2.0, agentfw 0.3.0,
soup-wall-adapter 0.1.0 and soup-wall-bench 0.2.0 — heterogeneous because they were
versioned independently before the repository was published, not because some are less
finished than others.

What is in it

A firewall for what an AI agent does — tool calls, tool results, MCP handshakes, subagent
spawns — running on one machine, with no account and no network call of its own.

• The daemon (agentfw): Claude Code hook collector, MCP proxy with manifest pinning and
  exact drift reporting, local JSONL audit, replay with a promotion verdict, preflight,
  signed single-use approval grants, and guarded execution.
• The reference monitor: taint tracking, action classes, egress-host control, subagent
  authority, first-match policy.
• The detectors: prompt injection (signatures, heuristics, optional local classifier),
  secrets, PII, improper output, tagged to OWASP LLM Top 10 and MITRE ATLAS.
• The gate (soup-wall-bench): replays a candidate policy against the reviewed corpus and
  refuses it if a known attack is now missed or benign work is now interrupted.

Downloads

Binaries for Linux x86-64, macOS (Apple silicon and Intel) and Windows x86-64, built from
this tag with the default feature set. The optional ml classifier is not compiled in:
it needs model assets you fetch yourself, and a binary that expected them would break the
single-command install.

SHA256SUMS covers every other file in this release:

sha256sum -c SHA256SUMS --ignore-missing

A CycloneDX SBOM (*.cdx.json) is attached, generated with --all-features so it covers the
optional classifier's dependency graph as well.

What this release does not claim

Read the README's limitations section before deploying it; nothing there is softened here.
The short version:

• Shadow mode is the default. Nothing is blocked until you complete the documented
  promotion sequence.
• The Claude Code hook fails open. If the daemon is not running, the host runs the tool
  anyway. Only the guarded execution path fails closed, because it owns process creation.
• The regression corpus is hand-authored — 19 attack and 21 benign sessions. No held-out
  or third-party evaluation (AgentDojo, InjecAgent) has been run, and no detection percentage
  is published on purpose.
• Guarded execution is Linux-only (bubblewrap). Other hosts fail closed.

Verifiable posture

• cargo audit: no vulnerabilities over 332 dependencies, with two allowed warnings
  (paste unmaintained, chacha20 yanked).
• CodeQL runs on this repository and its results are public. The first Rust analysis raised 21
  alerts and none are open; each dismissal carries its reasoning — the #[cfg(test)] boundary
  or the character-map sanitizer — on the alert itself.
• unsafe appears in exactly two places, both memory-mapping a model file, both documented.
• Every source file carries an SPDX identifier.
• A lock guard fails the build if a commercial-layer dependency ever enters Cargo.lock.

Apache-2.0. Derived from carbon-evolution/llm-firewall; see NOTICE.