Security

What the kernel protects

• Capability exposure. An agent can only call what an adapter declares. There is no path to an undeclared endpoint, and there is no catch-all proxy.
• Risk classification. Every call is evaluated before it leaves. A high capability is refused for agent actors whatever the caller claims.
• Credential handling. The agent never holds the upstream credential. It is resolved inside the kernel at call time.
• Prompt injection. Payloads are scanned for instruction-override and exfiltration patterns before they reach a target, and the signals are recorded.
• Audit integrity. Secrets in a payload are redacted before the audit row is written, not before it is displayed.

What it does not protect

TCPcore governs what an agent does when it calls an API. It is not a sandbox and it does not govern where an agent runs, what it can read locally, or what it does with a response it has already received. Those belong to the runtime and the network.

The governance controls themselves are never gated by a licence, including the risk gate and the audit trail.The test that asserts thisis in the public repository.

Reporting a vulnerability

Email security@tcpcore.dev with enough detail to reproduce. Please do not open a public issue for anything exploitable.

This address is not monitored yet. Until it is, open a private security advisory on thepublic repository.