Skip to content

v0.1.0 — Runtime trifecta detection (proof release)

Choose a tag to compare

View all tags
@yxshwanth yxshwanth released this 05 Jul 00:07
· 64 commits to main since this release
v0.1.0
5fbc364

First release — a working proof that runtime trifecta detection works across two observation planes.

Highlights

  • Variant A — chained-tool exfil prevented at the MCP proxy (hold-before-forward)
  • Variant B — server side-channel detected and contained via eBPF connect() tracing
  • Fused evidence timeline with cross-plane timeline_seq ordering
  • Self-contained HTML evidence viewer
  • Three-pass demo with quiet mode for recordings (make demo-quiet-ebpf)
  • 73 tests; CI on every push to main

Quickstart

git clone https://github.com/yxshwanth/Interlock.git
cd Interlock
sudo make demo-quiet-ebpf GO=$(which go)

Known limitations

  • Value-overlap is raw-substring matching — misses encoded/obfuscated exfil
  • Variant B is SUSPICIOUS at 0.60 confidence — unauthorized connection during a sensitive session, not proven exfiltration
  • eBPF containment is kill-after-connect, not first-packet prevention
  • STDIO transport only; single session; IPv4 connect() only
  • eBPF tested locally (root + BTF), not in CI

Full changelog: CHANGELOG.md
Roadmap: docs/ROADMAP.md

Assets 2
Loading