Vigil

The Runtime Firewall for Autonomous AI Agents

Comment

VIGIL — The Runtime Firewall for Autonomous AI Agents

Demo Video: https://drive.google.com/drive/folders/1aoqMZs1MCD1hEpMPQBcfNpNi-or2Eqnt?usp=sharing

Live Dashboard: https://vigil-featherless.vercel.app/

API: https://vigil-server.onrender.com/

GitHub: https://github.com/LSUDOKO/Vigil

Overview

VIGIL is a runtime governance and control plane for autonomous AI agents.

As AI agents become capable of executing commands, modifying files, calling APIs, using MCP tools, and operating for long periods without human supervision, a new problem emerges:

Who controls what an autonomous agent is allowed to do?

VIGIL sits between the AI agent and the tools it wants to use. Before an action is executed, VIGIL evaluates it across five dimensions:

  • Intent — Is the action consistent with the agent's objective?
  • Policy — Is the requested capability permitted?
  • Cost — Is the session within its budget?
  • Behavior — Is the agent behaving normally?
  • Security — Does the action introduce elevated risk?

VIGIL then makes an explicit runtime decision:

ALLOW · PAUSE · BLOCK · FALLBACK

When deterministic rules cannot confidently evaluate an action, VIGIL can escalate the decision to specialized AI models through Featherless.

Agents can act. VIGIL decides whether they should.

The Problem

Modern AI agents are no longer limited to generating text.

They can:

  • Read and modify files
  • Execute shell commands
  • Search repositories
  • Call external APIs
  • Access MCP tools
  • Interact with development environments
  • Run long-running workflows
  • Chain multiple tool calls autonomously

This introduces new failure modes:

  • Unexpected tool calls
  • Unsafe command execution
  • Infinite tool loops
  • Retry storms
  • Budget runaway
  • Policy violations
  • Unexpected network access
  • Behavioral drift

Traditional observability tells you what happened.

Static policies define what should be allowed.

Autonomous systems need another layer:

A runtime control layer capable of evaluating the next action before it executes.

The VIGIL Thesis

The next generation of agent infrastructure needs an enforceable boundary between:

What an agent wants to do

and

What the agent is allowed to execute.

VIGIL creates this boundary directly on the agent's execution path.

Agent → VIGIL → Governance Evaluation → Tool

Every governed action is evaluated before it reaches the underlying tool.

How VIGIL Works

VIGIL evaluates every governed action across five runtime signals:

Intent

Determines whether the requested action is consistent with the agent's declared objective.

Policy

Checks whether the requested tool or capability is explicitly allowed.

Cost

Tracks current spending, budget utilization, spend velocity, and projected cost.

Behavior

Detects unusual execution patterns such as repeated calls, retry storms, and behavioral drift.

Security

Evaluates whether an action introduces elevated security risk.

After evaluation, VIGIL produces one of four decisions:

ALLOW — Execute the action.

PAUSE — Stop and request review.

BLOCK — Prevent the action from executing.

FALLBACK — Safely recover using an alternative route.

Featherless Integration

Featherless is a core part of VIGIL's architecture.

VIGIL does not use an expensive AI model for every tool call.

Instead, it follows an adaptive pipeline:

Deterministic Checks → Fast Risk Model → Reasoning Model → Security Review

Clearly safe actions can be handled without model inference.

Ambiguous actions can be escalated to specialized models through Featherless.

Different model roles can be used for different governance tasks:

Model Role Purpose
Fast Risk Model High-frequency runtime classification
Reasoning Model Complex policy and risk analysis
Security Critic Adversarial security review
Fallback Model Resilience when a preferred model fails

This allows VIGIL to optimize governance across:

Security · Latency · Cost · Reasoning Quality

The key principle is:

The model recommends. VIGIL enforces.

AI-generated decisions cannot directly bypass deterministic security policies.

Intent-Aware Governance

Operators can define exactly what an agent is supposed to accomplish.

For example:

Task: Fix failing tests in a repository.

Allowed: Read files, search code, modify project files, run tests.

Denied: Network access, secrets, arbitrary shell commands.

Budget: $2.

A compliant action such as running tests can be allowed.

An unexpected network request can be detected as outside the agent's declared scope and blocked.

This creates an important distinction:

An agent's goal is not automatically permission to perform every action.

Runtime Tool Interception

VIGIL creates a governance boundary around tool execution.

Depending on the integration, VIGIL can govern:

  • MCP tools
  • File operations
  • Shell execution
  • Repository search
  • External APIs
  • Custom agent actions

Instead of:

Agent → Tool → Log what happened later

VIGIL provides:

Agent → VIGIL → Governance Decision → Tool

This allows intervention before an unsafe action reaches the tool.

Predictive Cost Governance

VIGIL treats cost as a runtime control signal, rather than only a billing metric.

It tracks:

  • Current spending
  • Budget utilization
  • Spend velocity
  • Recent usage
  • Projected session cost
  • Estimated budget exhaustion
  • Soft limits
  • Hard limits

For example, if an agent is approaching its budget while its projected spending is increasing rapidly, VIGIL can respond with:

WARNING → FALLBACK → PAUSE → STOP

This allows the system to intervene before a runaway agent exhausts its budget.

AI-Assisted Risk Evaluation

When deterministic rules cannot confidently resolve an action, VIGIL can send structured runtime information to a Featherless-hosted model.

The evaluation can include:

  • Agent intent
  • Active policy
  • Requested tool
  • Tool arguments
  • Recent execution history
  • Cost state
  • Runtime risk signals

The model returns a structured risk assessment containing information such as:

  • Risk score
  • Severity
  • Decision
  • Confidence
  • Reasons for the decision

The response is validated before it reaches the runtime decision layer.

This creates a controlled relationship between AI reasoning and enforcement:

AI provides judgment. VIGIL provides authority.

Natural Language Policy Generation

VIGIL can convert natural-language requirements into structured runtime policies.

For example:

Allow repository reads and test execution. Block network access and secrets. Limit the session to $2. Pause unknown shell commands.

This can be transformed into a structured policy containing:

  • Allowed tools
  • Denied tools
  • Budget limits
  • Pause conditions
  • Runtime restrictions

The generated policy is then:

  1. Schema validated
  2. Normalized
  3. Checked for unsafe configuration
  4. Presented for confirmation
  5. Activated in the runtime engine

The model proposes the policy.

It does not receive unrestricted authority over the policy engine.

Behavioral Threat Detection

A dangerous agent may not be identifiable from a single action.

VIGIL also monitors behavioral patterns such as:

  • Unusual tool frequency
  • Repeated operations
  • Retry storms
  • Unexpected tool transitions
  • Latency anomalies
  • Accelerating cost
  • Policy violations
  • Behavioral drift

For example, an agent may normally perform:

read_file → search_code → run_tests

But suddenly start performing:

search_code × 19 → shell commands × 8 → network requests × 3

VIGIL can identify this behavioral deviation and increase the risk level or pause the session.

The focus is not only on what the agent did, but also on whether its behavior is diverging from its expected execution pattern.

Recovery & Fallback

Not every abnormal event should terminate an agent.

Where a safe recovery exists, VIGIL can intervene without completely destroying useful autonomy.

Examples include:

  • Falling back to a lower-cost model
  • Using an alternative model when a preferred model fails
  • Applying circuit breakers to timed-out tools
  • Pausing high-risk operations
  • Blocking actions that violate policy

The principle is:

Preserve useful autonomy without surrendering runtime control.

Tamper-Evident Audit Trail

VIGIL records governance decisions as structured audit events.

Events can contain:

  • Timestamp
  • Session
  • Agent
  • Tool
  • Decision
  • Policy
  • Risk
  • Model
  • Cost
  • Reason
  • Trace ID
  • Previous hash
  • Current hash

Events can be chained using hashes to create a tamper-evident execution history.

This provides useful evidence for:

  • Debugging
  • Incident investigation
  • Runtime analysis
  • Governance
  • Auditing

Observability & Command Center

VIGIL integrates with OpenTelemetry to provide visibility across the complete agent lifecycle.

The system can correlate:

Agent → Session → Tool Request → Policy Decision → Model Evaluation → Runtime Action → Cost → Tool Result

The live command center is designed to answer four important questions:

What is the agent doing?

Is its behavior normal?

Is it within policy?

Should it continue?

The runtime state is always represented through:

ALLOW · PAUSE · BLOCK · FALLBACK

What Makes VIGIL Different?

Approach Primary Question
Traditional Observability What happened?
Static Policy What should be allowed?
AI Security Classification Is this behavior risky?
VIGIL Should this action execute right now?

The key difference is runtime enforcement.

VIGIL is not simply a dashboard that reports suspicious behavior after execution.

It is designed to sit directly on the execution path and intervene before an unsafe action reaches the tool.

Use Cases

Autonomous Coding Agents

Govern agents that:

  • Modify repositories
  • Execute tests
  • Access shells
  • Read and modify files
  • Interact with external services

MCP Workflows

VIGIL can sit between MCP clients and MCP tools to provide runtime governance.

Internal AI Platforms

Organizations can use VIGIL for:

  • Runtime budgets
  • Agent policies
  • Intervention
  • Behavioral monitoring
  • Audit trails

Long-Running Agent Automation

Govern autonomous workflows involving:

  • Multiple tools
  • External APIs
  • Inference costs
  • Autonomous execution

Why Featherless?

VIGIL is designed to make model diversity operationally useful.

Instead of forcing one model to perform every governance task, Featherless can provide different models for different runtime decisions.

The flow is:

Model Diversity → Task Specialization → Adaptive Routing → Runtime Governance

This allows VIGIL to optimize governance across:

Security · Latency · Cost · Reasoning

Featherless therefore acts as an important intelligence layer within the VIGIL architecture rather than being only an external API integration.

Technology Stack

Layer Technology
Runtime Go
Agent Protocol Model Context Protocol (MCP)
Governance Custom Runtime Policy Engine
AI Inference Featherless
Frontend Next.js / React
Styling Tailwind CSS
Real-Time WebSockets
Observability OpenTelemetry
Telemetry SigNoz
Authentication OAuth 2.1 / PKCE
Agent SDK Python
Testing Go Testing / Pytest / Playwright
Packaging Docker

Demo

The demo focuses on one clear scenario.

  1. An agent is given a specific task and a defined set of permissions.
  2. The agent performs normal operations such as reading files and running tests.
  3. The agent attempts an action outside its declared scope.
  4. VIGIL intercepts the action.
  5. VIGIL evaluates the action using intent, policy, behavior, cost, and security signals.
  6. If the action is ambiguous, Featherless provides additional AI-powered risk analysis.
  7. VIGIL makes the final decision.
  8. The decision is recorded in the dashboard and audit trail.

The key demonstration is:

An autonomous agent attempts an unauthorized action, VIGIL detects the violation, evaluates the risk, and prevents the action from executing.

Demo Video

https://drive.google.com/drive/folders/1aoqMZs1MCD1hEpMPQBcfNpNi-or2Eqnt?usp=sharing

Hackathon Fit

VIGIL is built for the Impact Forge: Summer 2026 Hackathon — General Innovation Track.

The project focuses on:

  • AI infrastructure
  • Autonomous agents
  • Developer tooling
  • Runtime security
  • Cost governance
  • MCP
  • Full-stack engineering
  • Adaptive AI inference

Rather than building another AI assistant, VIGIL focuses on the infrastructure required to make autonomous agents more controllable and deployable.

The project combines:

Runtime Enforcement · AI Risk Evaluation · Predictive Cost Governance · Behavioral Monitoring · Model Routing · Observability · Auditability

Vision

AI systems are becoming increasingly capable of taking real-world actions.

The infrastructure challenge is therefore changing.

The question is no longer only:

"Can the agent do it?"

It is:

"Should the agent be allowed to do it?"

VIGIL aims to become the runtime governance layer that answers that question.

Observe. Evaluate. Enforce.

Live Resources

Disclaimer

VIGIL is experimental infrastructure and does not guarantee secure or compliant autonomous execution.

Production deployments should be independently threat-modeled, tested, isolated, and hardened for their specific environment.

Built With

  • ai-firewall
  • featherless-api
  • go
  • mcp
  • next.js
  • python
Share this project:

Updates