Under the hood
How your bot reads requests without an AI model, the tools that check it, and the research behind them.
Smart where it matters, predictable everywhere else
Three things keep your agent useful, affordable and safe, and none of them asks you to understand how AI works.
It understands what people ask
Your agent reads each request against what each of your tools says it does, and picks the right one itself, without asking the AI model. It reads requests written in English or in Brazilian Portuguese, whichever you choose, accents typed or not. The same request always gets the same tool, and you can see why. It learns your customers' own words from their thumbs up and down, and keeps a new word only when it makes nothing worse.
It works with the tools you already have
Connect the systems your business already runs. Each tool is checked before your agent may use it: for secrets it could leak, data it could send where it shouldn't, and changes it could make with no way back. Then, every time, your rules decide: go ahead, ask a person first, or refuse.
The whole flow is checked before it runs
Before your agent, or a team of agents working together, goes live, every route through it is checked for a way to reach a risky action without its safeguard, such as a payment with no confirmation from the customer. If there is one, you see the exact route, before a customer finds it.
For teams that build AI agents
The Bot Builder to build your agent, and five safety and testing tools to check it and the rules around it, all behind one API key.
Bot Builder
Build your own AI agent on the tools your business already has, kept to your rules.
Build an agent with the stalwart-agents Python package: describe it in one agent.yaml file, or in Python with Agent and @tool. Its tools come from your Python functions, MCP servers, OpenAPI APIs, LangChain tools and TypeScript (@stalwart-agents/catalogue); its rules come from a simple rule sheet, or from the guardrail rulebook you already have. stalwart serve serves it, and @stalwart-agents/agent-ui gives it a white-label chat window.
Build yours in the console today: choose a template, chat with your bot, then run it on your computer.
What it does
- Picks the tool from the user's own words, read against the words each tool declares: no model call to choose, the same request gets the same tool, and every step names the rule that produced it
- Calls your model only where you allow it: a turn it cannot read, when your setting sends it on (by default it asks the user to rephrase); an agent that receives a hand-off; answers composed from your documents; or model-drafted replies
- Checks every tool call before it runs against your rule sheet (requires, requires_confirmation, never, after, when): allowed, sent to a person to confirm, or refused, with no model and no network involved
- One versioned catalogue imported from LangChain, MCP (tools/list), OpenAPI and TypeScript, with lints (a write with no undo; two tools that cannot be told apart block routing until fixed) and code checks on the tools' own Python, JavaScript, TypeScript and Go for network-security and credential problems. Every code finding fails, nothing can suppress it, and only the counts are sent to Stalwart
- Teams of agents through hand-offs (hands_off_to), with the agent graph verified before it runs: a dangerous path raises an error
- Answers from your own documents, indexed on your machine with no network: either the documents' own sentences, or an answer your model composes, checked against the passages it cites
- Reply rules: an outcome check so a reply never claims something was done that was not; cards, IBANs, national IDs, emails and phone numbers redacted or withheld; banned phrases removed and required disclaimers added
- Learns new words from your users' thumbs up and down, applying a change only when it makes nothing worse (five checks), with versions you can roll back. Feedback stays per customer and is never used to train models. In English and Brazilian Portuguese, each language learned on its own
- A licensed local runtime on your own machine, where conversations, tool calls and documents stay. The console manages catalogues, rule sheets, phrasings, reply rules, feedback, vocabulary, accuracy and findings
- Handles the calculations no tool covers by handing them to your model: the genie, called only when its power is needed, and never if you turn it off
Built for: Teams putting an AI agent to work on their own tools, documents and customers
Safety and testing tools
For the agent you build here, or for the guardrails, agent graphs and models you already run.
Agent Graph Verification
Check every route through your agent, or a team of agents, before it goes live.
Validates a LangGraph agent graph, with its tool catalogue, before it runs: every path is searched for a way to reach a risky action without its safeguard. The stalwart-agents SDK runs it automatically before an agent starts, and the API offers it as mode: graph.
What it does
- Checks every path for a tool reached without its check, a write without its confirmation, an order rule that can be escaped, a privileged tool after untrusted input (prompt injection) and saga or undo rules, over the session depth you set
- Findings include a write on an unguarded tool node, multi-turn escape, confused deputy, cascading injection through a hand-off, an irreversible step before an undoable one, the model writing code that runs or a query or destination, confidential data leaving, retrieval not bound to the user, untrusted content persisted, an unbounded loop, a write with no compensation, an unpinned tool source and an unauthenticated agent channel
- Each finding comes with the exact path, as SARIF, and its witness can be replayed on stub tools
- Nodes that are not Stalwart's own are treated as opaque, and a result holds up to the session depth checked
Built for: Teams building agents and multi-agent systems on LangGraph
Guardrail Bug Hunter
Find the ways past your AI's safety rules before an attacker or an accident does, each with a checked fix.
Scans guardrail policies (version 1, and a declared subset of version 2, of the leading open-source guardrail language), intermediate-representation rulebooks, a host's router, agent graphs with their catalogue, and a guardrail configuration with its dependencies against published advisories. Every route to a forbidden action comes back as a finding.
What it does
- Every finding has a severity, a reproduction (the conversation that triggers it, replayed) and a fix verified by scanning again
- Scans grouped into projects, each compared with the last: new, existing, fixed or reintroduced
- Triage as confirmed, false positive or accepted risk. An accepted risk needs a justification and expires, after 90 days by default
- A quality gate that can block a release, SARIF output and a GitHub Action
Built for: AI platform and security teams, and risk owners
Guardrail Verification
A yes-or-no answer, with evidence, to “can this agent ever do X without Y?”
Asks whether an action can be triggered without its safety context, for one rule or a whole property table at once. Every bypass comes back with a concrete example that has been verified.
What it does
- Check a single rule or a whole rule set, with a certificate for every rule
- Three profiles: fast (the default, about a quarter of a second, a verdict only, with no certificate and no repair), patch (a repair with a replayable certificate) and proof
- Every bypass comes with a verified witness: the concrete example that triggers it
- Certificates, and optional FRAT proofs, that you or your auditor can check independently and offline
- Every certificate download is access-logged, so your evidence has an access record
Built for: Risk and compliance teams, auditors and platform teams
Guardrail Writing
Write a rule in plain English and get back a policy checked against the obligation you name.
Describe a rule in plain language and name your own model (Anthropic, Gemini or any OpenAI-compatible endpoint). It drafts a policy in up to three rounds: each draft is compiled and checked against the obligation you name, and when the check fails, the solver's repair is fed back to your model for a redraft.
What it does
- Turns a plain-language rule into a draft policy, using your own model
- Verifies every draft, and repairs it when it is wrong
- Your key, your prompt and the model's raw answer are never stored
Built for: Policy authors and platform teams
Random Forest Verification
Show that your random-forest model behaves as required, or get the exact case where it does not.
Checks a trained random forest for robustness, monotonicity, fairness and reachability over the regions you declare, or searches exhaustively around real records. Models are read as ONNX-ML or Treelite JSON, and scikit-learn models through an ONNX export.
What it does
- Each violation comes with a counterexample re-checked on the model itself; otherwise a refutation, or an honest undecided
- The search around real records is exhaustive, not sampled, and returns verdicts
- Wide fairness or monotonicity regions may stall: narrow them to get an answer
Built for: Model risk, data science and compliance teams, for example in lending or insurance
We checked the public safety rules that a whole industry copies
We pointed the Guardrail Bug Hunter at the public safety-rule files of a leading open-source AI safety toolkit: its own library of ready-made rules, the sample assistants its maker publishes, and projects from partners and the community. 185 files from 12 public collections, checked offline, with no AI model involved.
Two files held real weaknesses, and each one was reproduced in the toolkit itself. The Bug Hunter can fix both: it writes a corrective rule for each, and checks that the rule closes the gap without blocking anything else.
These are professional examples that many teams copy, so every weakness travels with every copy. Testing by hand would have had to guess the right conversation. The Bug Hunter found each one, with the conversation that triggers it.
185
safety-rule files from 12 public collections
2
files with real weaknesses, each reproduced in the toolkit itself
32
actions anyone could trigger just by steering the conversation
8.5 s
to scan all 115 of the toolkit's files
Made-up answers reported as attacks
A rule that spots the AI making things up reports it as an attempt to trick the AI. A team that blocks those attempts blocks every made-up answer too, and a team that handles made-up answers never sees this rule's.
Three defects in a food-ordering assistant
Clearing the cart never runs, swapping an item checks the wrong value, and replies about the customer's order are left to AI-written text that nobody checks.
Actions anyone can trigger
32 actions in 28 files run on the user's apparent wish alone, so anyone who can steer the conversation can trigger them. Two of them place food orders with no check of who asked or whether they confirmed.
Figures from our research paper, for a scan run on 3 October 2026.
Low cost, relevant and safe by design, not by luck
An AI model left to run an agent on its own costs money on every decision, guesses at your business and acts on whatever it decides. Stalwart Agents puts your rules and your customers' words in charge, and calls the model only when it's needed.
| WHAT MATTERS | AN AI MODEL ON ITS OWN | STALWART AGENTS |
|---|---|---|
| Choosing what to do | Asks the AI model every time, and the answer can change | No model call: your agent picks the tool itself, and the same request gets the same tool |
| Acting in your systems | Whatever the model decides | Only when your rules allow; otherwise it asks a person or refuses |
| Your business's words | Rewrite the instructions, again | Learned from your customers' thumbs up and down, and reversible |
| Hidden routes to a risky action | Found when someone stumbles on one | Searched for before it runs, each shown with its exact route |
| Paying for the AI model | On every decision | Only when it's needed, or never if you turn it off |
A finance case study, step by step
Our technical demo runs the engine on a regulated-finance policy set: a trade-booking approval gate, a below-threshold exemption that opens a bypass, and a consumer-duty advice rule. Pick a case to see the policy, the verdict and the evidence.
Algebraic Guardrail Verification in Action
define user request_trade_booking
"book this contract note"
define flow trade_booking_gate
user request_trade_booking
if $four_eyes_approved
bot book_trade
else
bot refuse_unapproved_bookingMATHEMATICALLY SAFE (UNSAT)
The algebraic solver derives 0 = 1 in 5 steps. Over all possible 2^N runtime contexts, the action book_trade is provably unreachable unless four_eyes_approved is positively asserted.
Algebraic verification benchmarks
Regulatory policies, tool dispatch gates and state lookbacks, decided by deterministic finite-field elimination.
FCA Consumer Duty Advice Guardrail (410 Variables)
410-variable synthesized GF(2) circuit under FCA COBS/Duty obligations. Proved that advising permissions cannot be bypassed via targeted-support advice flows.
Middle-Office Trade Booking Dispatch Gate
Discovered an OR-accumulation hole in a sub-threshold booking exemption. Generated a minimally disruptive policy patch certified to block the vulnerability.
Multi-Step Velocity Chain State Lookback ($prev.v)
Stateful lookback verification enforcing dynamic transaction frequency caps across conversational turn state variables.