it-rat.com · LinkedIn · Email · All repositories
A new hire gets a contract, a budget, a badge and a manager. An AI agent usually gets an admin key and a prayer.
I build the services that close that gap, and I run them on real infrastructure before I write a word about them. Install the one that solves your problem today, not a platform: they share one agent identity and one event envelope, so any two of them already understand each other. Free and open source, Apache-2.0, self-hosted, no seats.
An illustration, not a live feed. The numbers are invented, the behaviour is not. An agent here is stopped four different ways and only one of them is money: a risky action refused after it touched untrusted data, a detected loop, a policy decision, and the budget breaker. The kernel band is Idryx's eBPF program on the sys_enter_connect tracepoint, which I have run: Linux only, it reads no payloads, and it reports rather than blocks.
| Money | TokenFuse the in-line kill switch: budget, loop detection, and risky actions blocked after untrusted data · CostCrew a crew of agents takes the cloud bill apart, a person signs it off |
| Policy | Wardryx policy decisions with a human in the loop · Scopyx agents reach the web through a decision, not around one |
| Identity | agent-passport one id, one delegation chain, one envelope · Vouchryx a delegation an agent can prove and a person can end · Idryx one graph for humans, keys and agents, and a Linux eBPF sensor for the ones nobody registered |
| Memory | Engram the SQLite of agent memory: embeddable, MCP-native, bitemporal |
| Quality | Verdryx cost per correctly resolved case, not per token · Mockryx fire drills that prove guardrails hold |
| Evidence | Trailryx a record nobody can quietly change or shorten · Qryx cryptography inventory and post-quantum risk |
| Operate | Genaryx the console · Heraldyx alerts with a link and never a button · taipan one command |
Start here: stack-up on your laptop, no Docker · stack-single on one box · stack-k8s on Kubernetes · terraform-provider-taipan as code
How one agent action moves through it
flowchart TB
A(["An agent wants to act"]) --> G
subgraph G ["Four questions, answered before anything happens"]
direction LR
ID["<b>Who is asking</b><br/>agent-passport, Vouchryx"] --> MON["<b>On whose money</b><br/>TokenFuse"] --> POL["<b>Is it allowed</b><br/>Wardryx"] --> EG["<b>May it leave</b><br/>Scopyx"]
end
G -- "yes" --> DO(["The action runs.<br/>Engram remembers why."])
G -- "no, or out of budget" --> STOP(["Stopped in line,<br/>not explained afterwards."])
DO --> EV["Both write the same event envelope.<br/><b>Trailryx</b> seals it: tamper-evident,<br/>and one person can still be erased."]
STOP --> EV
EV --> P(["A human reads it: the <b>Genaryx</b> console,<br/><b>Heraldyx</b> mail, the <b>CostCrew</b> bill"])
style STOP stroke-dasharray: 4 4
Around that line sit the checks that do not run inside it: Mockryx rehearses the guardrails before production, Verdryx scores the answers and watches for drift, Idryx maps who and what can do too much, Qryx keeps the cryptography inventory honest.
Thirteen services stay compatible because three small things are shared and gated, not agreed in a meeting: agent-passport is the spec, agent-stack-go is that spec as a Go module with cross-language vectors pinned, and estate-gates runs the checks no single repository can run on itself, including the one that asks whether every gate can still go red.
Nothing here is claimed, only measured
- PROVEN.md records what has actually been executed: the date, the machine, and the artifact you can open. Runs that have not happened are listed too, with the gap named.
- The same stack has been brought up on Hetzner, AWS and GCP, and the traps that cost us the nights are written down in stack-k8s rather than quietly fixed.
- game-day-on-bedrock rehearses three Amazon Bedrock faults as a CI job, so the exit code is the whole result.
- Each figure on the it-rat.com service pages names the command that measures it and the date it was last run, and a publish whose pages disagree with that ledger is refused.
Tagged releases: 
Elsewhere on this profile
- hermes-openwrt runs Hermes Agent as a native OpenWrt package: apk, procd, UCI, no Docker and no chroot. Its neighbour openwrt-mcp is upstream's MCP server on the router, six tools over ubus with an armed rollback timer; I contributed its OpenWrt 25.12 package.
- telegram-mcp-claude gives an assistant real Telegram tools: read, send, edit, pin, react, files.
- TokenFuse Pocket is the kill switch on a device the agent's host never touches. A side project, signed on-device, and not wired into the stack yet.
- sphere-ios is a personal one: twelve life spheres, on-device memory, SwiftUI.
Ask me about Go, Rust, Kubernetes, cloud IAM and FinOps, and about what actually breaks when an agent gets an API key. I am learning applied cryptography, which is why TokenFuse, Trailryx and Genaryx are Rust, and I am always interested in hard problems in agent security and governance.
yukosemail@gmail.com · LinkedIn · X · London, UK