Skip to content

v0.5.0: agentdryrun (renamed), GitHub Action, Recorder, hardened verifier

Choose a tag to compare

View all tags
@ntinosgkiou-code ntinosgkiou-code released this 25 Oct 18:02
· 19 commits to main since this release
v0.5.0
1914c6d

agentdryrun is a dry run for AI agents. Record what an agent's tools did, see what your rules would have blocked or sent for approval, and keep a record nobody can quietly edit. Local, standard library only, nothing is sent anywhere.

What is new in 0.5.0

  • New name. The project was called OmniOS, which is also an unrelated operating system. It is now agentdryrun. The old repository URL redirects. The evidence-bundle format identifier omnios-evidence-bundle is kept on purpose so existing signed bundles keep verifying.
  • GitHub Action. Run the dry run on every pull request and fail the build when more actions would be refused, would need approval, or use a tool no rule covers than you accept. It writes a job summary table, uploads the HTML report and exits with code 4 over a limit. Tested in this repository's own CI on Linux and Windows, including the case where it must fail.
- uses: ntinosgkiou-code/agentdryrun@v0.5.0
  with:
    rules: rules.json
    events: tests/agent-events.jsonl
    max-refused: 0
    max-unmapped: 0
  • New flags: shadow --max-refused / --max-pending / --max-unmapped / --summary-md.
  • README leads with the problem, badges, and the same one-command demo.

Already in the last releases

  • Recorder: two lines around your agent's tool functions write what it does to a local file (@rec.tool("payments.send")). Keeps only the fields your rules look at; never breaks your agent.
  • Readers for Langfuse, LangSmith and OpenTelemetry exports (field names checked against the primary sources; not yet run on real exports).
  • A verifier that was attacked and fixed: 76 hostile bundles; the one real hole (records omitted under a relabelled scope) is closed (INCOMPLETE warning, --require-all).
  • pip install git+https://github.com/ntinosgkiou-code/agentdryrun, python -m agentdryrun demo, 74 tests on Python 3.9, 3.11 and 3.12.

What it is not

A prototype with no external security review. It does not certify anything, does not make you compliant with any regulation, and does not stop prompt injection. The recorder logs attempts, not outcomes or approvals. The example data is invented. Read docs/KNOWN-LIMITS.md.

Help wanted

The most useful things you can do: try the readers on a real export and send a redacted sample if it fails; try to break the verifier; pick a good first issue.

Assets 2
Loading