XRisk

Allow.Confirm.Block.

XRisk sits between an agent’s intended action and the thing that executes it. It checks policy, prompts, secrets and network use, then returns one of those three answers, with the reasons attached.

Install XRiskHow it decides
Executor Agent · read_file
checking

Pick an action to see what XRisk does with it.

risk

Illustrative. Real decisions come from your own policy pack.

Policy, prompts, secrets and egress in one check
Open source under Apache 2.0
Runs with Node.js or as a standalone binary

Agents fail in predictable ways: tools with too much power, prompts that get hijacked, secrets that leak, and requests that head somewhere they shouldn’t. XRisk sits in the gap between intent and action and says allow, confirm or block, with its reasons attached.

From intent to decision.

Policy comes first

Rules from global, project and user layers are matched against the action. The most restrictive effect wins: block over confirm over allow.

Then the content

The prompt is inspected for injection and anomalies. The payload is checked for secrets and personal data.

Then the boundaries

Role limits, capability tokens and network egress rules decide whether this actor can do this thing, and reach that address.

Then a decision, on the record

Risk signals are combined, the circuit breaker updates, and the decision lands in a hash-chained audit trail with reasons attached.

Policy
globalprojectuser
Content
prompt injectionsecrets and PII
Boundaries
rolecapability tokenegress
Decision
allowconfirmblock
deploy

Guardrails that work together.

Policy as code

Layered global, project and user rules, validated against a schema. Check policy packs in CI for conflicts, shadowed rules and critical allow overrides before they roll out.

blockbeats confirmbeats allow

Explainable risk

Weighted scoring with a breakdown. Every decision says why.

Prompt-injection detection

Inspects prompts and scores anomalies before the action runs.

Secrets and PII

Detects sensitive data and gives you redaction utilities.

Capability tokens

Sandbox what an actor may do, and for how long.

scopeTTLsingle-use

Egress control

Allowlists and denylists for outbound network requests.

Circuit breaker

Stops repeated loops and escalating risk before they snowball.

Tamper-evident audit trail

Decisions are written to a hash chain. Deterministic forensic hashes let you replay a past decision and check it still holds.

Supply-chain gates

Signature and provenance checks before enforcement.

Model output checks

Verifies consistency and evidence in what the model claims.

Install XRisk.

Four ways to get the same xrisk command. Start with npx if you only want to try it.

Fastest to trynpxZero-install. Runs the check without adding anything to your machine.
npx xrisk-engine assess --action-file examples/action.json
curlA standalone binary. No Node.js or npm needed.
curl -fsSL https://raw.githubusercontent.com/Hootsworth/XRisk/main/install.sh | sh
HomebrewA system package for macOS or Linux.
brew tap hootsworth/xrisk
brew install xrisk
npmInstall globally in your Node environment.
npm install -g xrisk-engine

Prefer to embed it? The README covers createNodeXRisk on the GitHub page.

Use it from the terminal.

Pipe in an action and read the decision. Pick a profile to match how strict you need to be. XRisk is a safety layer, not a replacement for hardening your infrastructure.

assessAllow, confirm or block a proposed actionverify-modelCheck model output for consistency and evidencevalidate-policiesCatch policy problems before rolloutprofilesdeveloper, enterprise or high_security
terminal
# assess an action from stdin echo '{"tool":"read_file","actorRole":"planner"}' | xrisk assess --profile developer # assess with your own policy pack xrisk assess --action-file examples/action.json \ --policies-file examples/policies/baseline-policy-pack.json \ --profile enterprise # verify model output xrisk verify-model --input-file examples/verify-model-input.json --profile enterprise # gate policy changes in CI xrisk validate-policies --policies-file examples/policies/baseline-policy-pack.json

Where it’s going.

Shipped

  • Policy pack verification
  • Supply-chain integrity enforcement
  • Deterministic forensics and replay
  • Installers for npx, curl and Homebrew
  • An interactive validation playground

Planned

  • Real-time threat intelligence correlation
  • Zero-trust workload identity
  • Autonomous containment orchestration
  • An adversarial simulation harness
  • Multi-party cryptographic approvals
  • Data lineage and purpose-bound controls

Open source, and open to contributions.

XRisk is released under the Apache License 2.0. Fork it, add tests for any behaviour change, run npm test, and explain policy or risk changes in your pull request.

View on GitHubInstall XRisk