Show HN: I built a static verifier for OpenCode to stop unsafe AI tool calls

Notifications You must be signed in to change notification settings

Fork 0

Star 0

BranchesTags

Open more actions menu

Folders and files

NameName

Last commit message

Last commit date

Latest commit

History

1 Commit

1 Commit

guardians-core @ 59e52d9

guardians-core @ 59e52d9

server

server

.gitmodules

.gitmodules

README.md

README.md

index.ts

index.ts

package.json

package.json

tsconfig.json

tsconfig.json

Repository files navigation

Static formal verification plugin for OpenCode powered by Guardians.

An implementation of the ideas in Erik Meijer's CACM paper "Guardians of the Agents", bringing code/data separation, Z3 path containment, secret taint analysis, and security automata state machines to OpenCode tool executions (bash, read, edit, write).

🏛️ Architecture

┌─────────────────────────────────────────────────────────────────────────────┐ │ OpenCode Agent Loop │ │ OpenCode AI proposes a tool call (e.g. bash, read, edit, write) │ └──────────────────────────────────────┬──────────────────────────────────────┘ │ ▼ Intercepted before tool runs ┌─────────────────────────────────────────────────────────────────────────────┐ │ OpenCode Plugin (opencode-plugin-guardians/index.ts) │ │ Fires OpenCode's native 'tool.execute.before' hook │ └──────────────────────────────────────┬──────────────────────────────────────┘ │ ▼ HTTP POST http://127.0.0.1:8765/verify ┌─────────────────────────────────────────────────────────────────────────────┐ │ Guardians Python Verification Sidecar Daemon │ │ Module: server/server.py (uses linked guardians-core submodule) │ │ Evaluates: Path containment (Z3), Taint analysis, Security Automata │ └───────────────────────┬───────────────────────────────┬─────────────────────┘ │ │ Rejected (ok = false) Accepted (ok = true) │ │ ▼ ▼ Hook throws Error(...) Hook resolves cleanly Tool execution ABORTED! OpenCode executes tool Violations fed back to LLM.

🚀 Installation & Quickstart

1. Register Plugin in opencode.json

Add opencode-plugin-guardians to your global (~/.config/opencode/opencode.json) or project-level opencode.json:

{ "$schema": "https://opencode.ai/config.json", "plugin": [ "opencode-plugin-guardians" ] }

1. Start the Guardians Verification Sidecar

git clone --recursive https://github.com/albertjoseph/opencode-plugin-guardians.git cd opencode-plugin-guardians

Install Python requirements (pydantic & z3-solver)

pip install -r server/requirements.txt

Start sidecar daemon

python3 server/server.py

🛡️ What is Checked

Path Containment (Z3 & Sandboxing): Prevents path traversal (../../../../etc/passwd, /etc/shadow, ../../.env).

Secret Taint Protection: Prevents reading sensitive secret files (.env, credentials.json, id_rsa) and leaking them into files or command strings.

Security Automata: Enforces read_file or list_files before allowing file modifications (edit_file).

📄 License

MIT License. Core verifier provided by the upstream Guardians repository linked as a git submodule (guardians-core).

Resources

Readme

Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks

Report repository