Prompt guardrails fail when models get smart. Bartholomew is an inline execution harness for AI agents (Claude, Cursor) that provides atomic 2µs filesystem micro-rollbacks, in-flight secret scrubbing, and offline Merkle audit trails before your OS is touched.
Over the past year, we watched AI agents evolve from conversational assistants into autonomous engines executing shell scripts, modifying codebases, and orchestrating multi-agent swarms.
The problem? LLM prompt guardrails are probabilistic. When an agent enters a runaway loop or attempts an unauthorized file deletion, prompt filters either miss it or return a blunt refusal that sends the agent into a hallucination spiral.
We built Bartholomew (BTP v2.5) as a deterministic execution runtime and transparent MCP security proxy: - Sub-Microsecond OS Event Gating (0.95 µs): Blocks unauthorized desktop clicks and synthetic keystrokes before they hit the OS. - Transactional Micro-Rollbacks: Memory-mapped Copy-on-Write snapshots restore pristine code in milliseconds if an agent acts out of bounds. - In-Flight Secret Redaction: High-entropy keys (AWS, GitHub, OpenAI) are scrubbed from incoming tool arguments and outgoing stdout streams. - Zero-Config MCP Gateway: Works out of the box with Claude Desktop, Cursor, Windsurf, and custom MCP clients.
Hey Product Hunt! I'm the creator of Bartholomew.
Over the past year, we watched AI agents evolve from conversational assistants into autonomous engines executing shell scripts, modifying codebases, and orchestrating multi-agent swarms.
The problem? LLM prompt guardrails are probabilistic. When an agent enters a runaway loop or attempts an unauthorized file deletion, prompt filters either miss it or return a blunt refusal that sends the agent into a hallucination spiral.
We built Bartholomew (BTP v2.5) as a deterministic execution runtime and transparent MCP security proxy:
- Sub-Microsecond OS Event Gating (0.95 µs): Blocks unauthorized desktop clicks and synthetic keystrokes before they hit the OS.
- Transactional Micro-Rollbacks: Memory-mapped Copy-on-Write snapshots restore pristine code in milliseconds if an agent acts out of bounds.
- In-Flight Secret Redaction: High-entropy keys (AWS, GitHub, OpenAI) are scrubbed from incoming tool arguments and outgoing stdout streams.
- Zero-Config MCP Gateway: Works out of the box with Claude Desktop, Cursor, Windsurf, and custom MCP clients.
Try it with zero install: npx btp-guard or pip install btp-guard.
Academic manuscript & proofs: https://doi.org/10.5281/zenodo.2...
Live demo & docs: https://bartholomew.info
Would love your brutal feedback, edge-case tests, and questions!