ATBASH — Route. Verify. Record.

Loading…

codex plugin marketplace add Atbash-Ai/atbash-chatgpt-plugin --ref main
codex plugin add atbash@atbash-ai

text
Use $atbash-setup to set up Atbash for this Codex session. Help me create a new agent or connect an existing one, then continue setup after I finish the browser steps until the local agent status is ready.

bash
ls "${CODEX_HOME:-$HOME/.codex}/plugins/cache/atbash-ai/atbash/"

bash
ATBASH_CODEX_PLUGIN="${CODEX_HOME:-$HOME/.codex}/plugins/cache/atbash-ai/atbash/<installed-version>"
node "$ATBASH_CODEX_PLUGIN/runtime/install-hook.cjs" --dry-run
node "$ATBASH_CODEX_PLUGIN/runtime/install-hook.cjs"

bash
node "$ATBASH_CODEX_PLUGIN/runtime/status.cjs"

bash
codex plugin marketplace upgrade atbash-ai
codex plugin add atbash@atbash-ai

bash
codex plugin marketplace add Atbash-Ai/atbash-chatgpt-plugin --ref dev
codex plugin add atbash@atbash-ai

text
Use $atbash-manage to help me update my Atbash agent through a new browser-authorized session.

bash
claude plugin marketplace add Atbash-Ai/atbash-claude-plugin
claude plugin install atbash@atbash-ai

text
/plugin marketplace add Atbash-Ai/atbash-claude-plugin
/plugin install atbash@atbash-ai

text
Use the atbash-setup skill to set up Atbash for this Claude Code session. Help me create a new agent or connect an existing one, then continue setup after I finish the browser steps until the local agent status is ready.

bash
ls ~/.claude/plugins/cache/atbash-ai/atbash/

bash
ATBASH_CLAUDE_PLUGIN="$HOME/.claude/plugins/cache/atbash-ai/atbash/<installed-version>"
node "$ATBASH_CLAUDE_PLUGIN/runtime/status.cjs"

bash
claude plugin marketplace update atbash-ai
claude plugin update atbash@atbash-ai

bash
claude plugin marketplace add Atbash-Ai/atbash-claude-plugin#dev
claude plugin install atbash@atbash-ai

bash
git clone --branch dev --depth 1 https://github.com/Atbash-Ai/atbash-claude-plugin.git ~/atbash-claude-plugin-dev
claude plugin marketplace add ~/atbash-claude-plugin-dev
claude plugin install atbash@atbash-ai

text
Use the atbash-manage skill to help me update my Atbash agent through a new browser-authorized session.

bash
openclaw plugins install @atbash/atbash-openclaw

bash
openclaw plugins list

json
{
  "plugins": {
    "entries": {
      "atbash-openclaw": {
        "enabled": true,
        "config": {
          "enabled": true,
          "enforceDecision": true,
          "chromiaSecretPath": "~/.config/atbash/guard-client-key",
          "orgName": "<your org name>"
        },
        "hooks": {
          "allowConversationAccess": true,
          "allowPromptInjection": true,
          "timeoutMs": 30000
        }
      }
    }
  }
}

Field	Type	Default	What it does
`enabled`	bool	`true`	Master switch. `false` = plugin returns immediately.
`enforceDecision`	bool	`true`	Fail-closed switch. When `true` (default), verdicts of `BLOCK`, `HOLD`, `ERROR`, and any unrecognized verdict block the tool call. When `false`, the plugin runs fail-open: all verdicts allow the tool call through and the outcome is only logged — useful for monitoring without enforcement.
`chromiaSecretPath`	string	`~/.config/atbash/guard-client-key`	Path to the agent key file. Supports `~/`.
`orgName`	string	—	Organization the agent was onboarded under, spelled as the dashboard shows it. The plugin resolves which chain to query from this; without it, it uses the SDK's default chain.

Field	Type	Default	What it does
`timeoutMs`	integer	OpenClaw default	Maximum milliseconds OpenClaw waits for the plugin's `before_tool_call` hook to complete before timing it out. Set to e.g. `30000` when your judge calls can be slow and you want a hard ceiling rather than relying on the host's global hook timeout.
`allowConversationAccess`	bool	`false`	Grants the plugin access to conversation-lifecycle hook families (`before_agent_run`, `llm_input`, `llm_output`, `agent_end`). The current version of the plugin does not use these hooks — set `true` to allow future versions to access them without a config change.
`allowPromptInjection`	bool	`false`	Grants access to the `before_prompt_build` hook family. The current plugin does not use this hook — same forward-compatibility rationale as above.

bash
openclaw plugins update atbash-openclaw

bash
openclaw plugins uninstall atbash-openclaw

[atbash] redacted secrets before judge call { tool: "exec", count: 2, kinds: ["anthropic", "generic_token"] }

npm install @atbash/atbash-autogen

Variable	Required	Default	Description
`ATBASH_AGENT_PRIVKEY`	Yes	—	Agent private key (hex). Used to sign every judge request.
`ATBASH_ORG_NAME`	Conditional	—	Your Atbash org name. Required for orgs on a private Chromia chain; omit for public-chain orgs.
`ATBASH_ENDPOINT`	No	Atbash production	Judge endpoint URL. Must be https, no URL credentials, and an allowlisted Atbash hostname.

ts
import { Atbash } from "@atbash/sdk";
import { judgeForAutoGen } from "@atbash/atbash-autogen";

const client = Atbash.fromConfig({ agentKey: process.env.ATBASH_AGENT_PRIVKEY });

const result = await judgeForAutoGen(
  {
    action: "Bank transfer $25 to a new external vendor account",
    context: "AutoGen agent checking transfer before execution",
    toolName: "send_bank_transfer",
    toolArgs: { amount: 25, recipient: "new vendor" },
  },
  client,
);

if (result.allow) {
  // proceed
} else {
  // stop — surface result.reason to the operator
}

Parameter	Type	Description
`input`	`AutoGenJudgeInput`	The action to evaluate
`client`	`Atbash`	SDK client created with `Atbash.fromConfig()`
`guardManager`	`MemoryGuardManager?`	Optional memory guard from `createAtbashGuardManager()`

Field	Type	Required	Description
`action`	`string`	Yes	Human-readable description of the action
`context`	`string`	Yes	Why the agent is taking this action
`toolName`	`string`	No	Name of the tool being called (defaults to `"autogen_action"`)
`toolArgs`	`unknown`	No	Structured payload the judge evaluates (defaults to `{ action }`)

Field	Type	Description
`allow`	`boolean`	Whether to proceed
`verdict`	`"ALLOW"	"HOLD"
`reason`	`string?`	Policy reason (present on HOLD/BLOCK)
`toolCallId`	`string?`	ID to pass back on HOLD resolution

Verdict	Meaning	Action
`ALLOW`	Safe to proceed	Continue orchestration
`HOLD`	Needs human review	Stop and hand off; keep `toolCallId`
`BLOCK`	Policy violation	Stop and surface `reason`
`ERROR`	Judge unreachable, or the judge returned no enforceable verdict	Fail closed, always

ts
import { createAtbashGuardManager, judgeForAutoGen } from "@atbash/atbash-autogen";

const guard = createAtbashGuardManager(client, { workspaceDir: "~/agent" });
const result = await judgeForAutoGen(input, client, guard);

Option	Type	Default	Description
`workspaceDir`	`string`	`process.cwd()`	Agent workspace directory; `~` is expanded
`memoryFilePath`	`string`	`workspaceDir/MEMORY.md`	Explicit MEMORY.md path; overrides `workspaceDir`
`ttlMs`	`number`	`30000`	How long (ms) to trust the local memory pointer between chain checks
`rollbackMinScore`	`number`	`1`	Block memory reads when a rolled-back version scores below this (1–10); default 1 = warn only
`memoryPathPatterns`

ts
import { Atbash } from "@atbash/sdk";

const client = Atbash.fromConfig({ agentKey: process.env.ATBASH_AGENT_PRIVKEY });

ts
const client = Atbash.fromConfig({
  agentKey: process.env.ATBASH_AGENT_PRIVKEY,
  judge: { endpoint: process.env.ATBASH_ENDPOINT },
});

ts
import { shutdownAtbashAutogen } from "@atbash/atbash-autogen";

process.on("SIGTERM", async () => {
  await shutdownAtbashAutogen();
  // ... your own shutdown, then exit
});

bash
cd examples/autogen-runtime-agent
ATBASH_AGENT_PRIVKEY=your_key_here node run.mjs

pre_tool_call

bash
uv pip install --python ~/.hermes/hermes-agent/venv/bin/python atbash-hermes-plugin

bash
uv pip install --python ~/.hermes/hermes-agent/venv/bin/python --upgrade atbash-hermes-plugin

bash
uv pip uninstall --python ~/.hermes/hermes-agent/venv/bin/python atbash-hermes-plugin

yaml
plugins:
  enabled:
    - atbash-hermes-plugin

bash
ATBASH_KEY_PATH=$HOME/.config/atbash/guard-client-key
ATBASH_ENFORCE_DECISION=true
ATBASH_DEBUG=false
ATBASH_ORG_NAME=your-org-name

bash
ATBASH_AGENT_PRIVKEY='{"pubkey":"...","privkey":"..."}'

Variable	Default	What it does
`ATBASH_ENDPOINT`	—	Override the Atbash API endpoint
`ATBASH_ENFORCE_DECISION`	`true`	Fail closed when Atbash cannot be reached
`ATBASH_DEBUG`	`false`	Verbose plugin logs
`ATBASH_ORG_NAME`	—	Resolves the org subscription, so the SDK picks the public or private chain
`ATBASH_TOOL_MAP_PATH`	`~/.config/atbash/hermes-tool-map.json`	Where learned tool classifications are saved
`ATBASH_MEMORY_HASH_PATH`	`~/.config/atbash/hermes-memory-hashes.json`	Where the persistent memory-tamper hash store is saved
`ATBASH_JUDGE_ENDPOINT_POLICY`

bash
hermes plugins list | grep atbash

bash
hermes plugins enable atbash-hermes-plugin

text
[atbash-hermes-plugin] registered pre_tool_call hook mode=fail-closed
Atbash pre_tool_call enter tool=...
Atbash verdict tool=... verdict=ALLOW reason=...

bash
docker run --rm -it \
  -v ~/.hermes:/opt/data \
  -e ATBASH_KEY_PATH=/opt/data/atbash/guard-client-key \
  -e ATBASH_ENFORCE_DECISION=true \
  -e ATBASH_ORG_NAME=your-org-name \
  nousresearch/hermes-agent

bash
mkdir -p ~/.config/atbash
printf '{"enabled": false}\n' > ~/.config/atbash/telemetry.json

bash
npm install @atbash/atbash-mcp

json
{
  "mcpServers": {
    "atbash": {
      "command": "npx",
      "args": ["-y", "@atbash/atbash-mcp"],
      "env": {
        "ATBASH_AGENT_PRIVKEY": "your_agent_private_key_here",
        "ATBASH_ORG_NAME": "your_org_name"
      }
    }
  }
}

js
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "npx",
  args: ["-y", "@atbash/atbash-mcp"],
  env: {
    ...process.env,
    ATBASH_AGENT_PRIVKEY: process.env.ATBASH_AGENT_PRIVKEY,
    ATBASH_ORG_NAME: process.env.ATBASH_ORG_NAME,
  },
});

Variable	Required	Description
`ATBASH_AGENT_PRIVKEY`	Yes	Your Atbash agent private key
`ATBASH_ORG_NAME`	Recommended	Your organization name. The SDK resolves the correct chain from it; without it, calls fall back to the SDK's default chain.
`ATBASH_ENDPOINT`	No	Override the default Atbash endpoint (`https://atbash.ai`)
`ATBASH_FAIL_CLOSED`	—	Has no effect. The MCP server is unconditionally fail-closed — judge errors always block, regardless of this variable.

Input	Type	Required	Description
`action`	string	Yes	Plain text description of the action
`context`	string	Yes	Why this action is being taken
`tool_name`	string	No	Name of the tool being called
`tool_args_json`	string	No	JSON string of tool arguments

Input	Type	Required
`action`	string	Yes
`context`	string	Yes
`tool_name`	string	No
`tool_args_json`	string	No

Input	Type	Description
`pubkey`	string	Agent public key (defaults to server agent)

Input	Type	Description
`tool_call_id`	string	ID returned from `atbash_judge`
`agent_pubkey`	string	Agent public key (defaults to server agent)

Tool	Description
`atbash_get_policy`	Get agent policy and blocked status
`atbash_get_agent_detail`	Get agent metadata
`atbash_get_tool_calls`	List recent tool calls across all agents
`atbash_get_agent_tool_calls`	List recent tool calls for one agent
`atbash_get_org_tool_calls`	List recent tool calls for an organization
`atbash_get_tool_call_full`	Get full detail for a single tool call
`atbash_get_tool_call_count`	Get total on-chain tool call count
`atbash_get_tier_info`	Get organization tier information
`atbash_get_held_actions`	List actions pending operator review
`atbash_get_reviews`

Verdict	Meaning	What to do
`ALLOW`	Safe to proceed	Execute the real tool only when `allow` is also exactly `true`
`HOLD`	Pending operator review	Do not proceed; keep `tool_call_id` to poll status later
`BLOCK`	Policy violation	Stop; show `reason` to operator
`ERROR`	Judge unreachable	Fail closed — do not proceed

json
{ "action": "do payment", "context": "finance" }

json
{
  "action": "Bank transfer $25 to a new external vendor account",
  "context": "Treasury payout review before execution",
  "tool_name": "send_bank_transfer",
  "tool_args_json": "{\"amount\":25,\"recipient\":\"new vendor\"}"
}

bash
npm install && npm run build
ATBASH_AGENT_PRIVKEY=your_key_here ATBASH_ORG_NAME=your_org node examples/mcp-runtime-agent/client.mjs

bash
npm install @atbash/atbash-langchain

bash
npm install @langchain/core  # >=0.3.0 required

ts
import { Atbash } from "@atbash/sdk";
import { DynamicStructuredTool } from "@langchain/core/tools";
import { AtbashGuardError, withAtbashGuard } from "@atbash/atbash-langchain";
import { z } from "zod";

const client = new Atbash(process.env.ATBASH_AGENT_PRIVKEY, {
  orgName: process.env.ATBASH_ORG_NAME,
});

const tool = new DynamicStructuredTool({
  name: "send_bank_transfer",
  description: "Send a bank transfer to an external vendor account",
  schema: z.object({ request: z.string() }),
  func: async (input) => `Executed: ${input.request}`,
});

withAtbashGuard(tool, client);

try {
  const result = await tool.invoke({ request: "Transfer $25 to vendor" });
  console.log(result);
} catch (error) {
  if (error instanceof AtbashGuardError) {
    // HOLD, BLOCK or ERROR — the tool did NOT run
    console.error(error.atbashVerdict, error.atbashReason);
  } else {
    throw error;
  }
}

Parameter	Type	Description
`tool`	`DynamicStructuredTool`	The tool to guard
`client`	`Atbash`	SDK client — `new Atbash(privkey, opts)` or `Atbash.fromConfig(opts)`
`guardManager`	`MemoryGuardManager`	Optional. Screens memory writes for poisoning before the judge call

Option	Type	Default	Description
`workspaceDir`	`string`	`process.cwd()`	Agent workspace directory. `~` is expanded.
`memoryFilePath`	`string`	`workspaceDir/MEMORY.md`	Explicit MEMORY.md path. Overrides `workspaceDir`.
`ttlMs`	`number`	`30000`	How long (ms) to trust the local pointer between chain checks.
`rollbackMinScore`	`number`	`1`	Block memory reads when a rolled-back version scores below this (1–10). Default 1 = warn only.
`memoryPathPatterns`

Verdict	Behavior
`ALLOW`	Original tool `func` runs normally
`HOLD`	Throws `AtbashGuardError`. Nothing executes. Approve or reject from the Atbash dashboard, then ask the agent to retry
`BLOCK`	Throws `AtbashGuardError` with the policy reason
`ERROR`	Throws `AtbashGuardError`. Fails closed — the tool does not run when the judge is unreachable

Field	Type	Description
`atbashVerdict`	`string`	`"ALLOW"`, `"HOLD"`, `"BLOCK"`, `"ERROR"`, or an unrecognised verdict passed through verbatim
`atbashReason`	`string	null`
`atbashToolCallId`	`string	null`
`atbashSource`	`"judge"	"memory-guard"`

ts
import { Atbash } from "@atbash/sdk";

const client = new Atbash(process.env.ATBASH_AGENT_PRIVKEY, {
  orgName: process.env.ATBASH_ORG_NAME,
  endpoint: process.env.ATBASH_ENDPOINT,
});

ts
import { shutdownAtbashLangchain } from "@atbash/atbash-langchain";

process.on("SIGTERM", async () => {
  await shutdownAtbashLangchain(); // never rejects
  process.exit(0);
});

Variable	Required	Description
`ATBASH_AGENT_PRIVKEY`	Yes	Your Atbash agent private key
`ATBASH_ORG_NAME`	No	Default org, used to resolve the chain on every judged call
`ATBASH_ENDPOINT`	No	Override the default Atbash endpoint (`https://atbash.ai`)

bash
npm install && npm run build
cd examples/langchain-runtime-agent && npm install && cd ../..
ATBASH_AGENT_PRIVKEY=your_key_here node examples/langchain-runtime-agent/run.mjs

bash
npm install @atbash/atbash-langgraph

bash
npm install @langchain/core @langchain/langgraph

ts
import { StateGraph, START, END, MemorySaver } from "@langchain/langgraph";
import { AtbashStateAnnotation, addAtbashSafety } from "@atbash/atbash-langgraph";

const builder = new StateGraph(AtbashStateAnnotation)
  .addNode("agent", agentNode)
  .addNode("tools", toolsNode)
  .addEdge(START, "agent")
  .addConditionalEdges("agent", routeAfterAgent);

addAtbashSafety(builder, {
  privkey: process.env.ATBASH_AGENT_PRIVKEY,
});

const app = builder.compile({ checkpointer: new MemorySaver() });

Option	Type	Default	Description
`privkey`	`string`	—	Agent private key (falls back to `ATBASH_AGENT_PRIVKEY` env var)
`endpoint`	`string`	`https://atbash.ai`	Override Atbash endpoint
`toolsNode`	`string`	`"tools"`	Name of the tools node in your graph
`agentNode`	`string`	`"agent"`	Name of the agent node in your graph
`workspaceDir`	`string`	`process.cwd()`

Field	Type	Description
`atbashVerdict`	`string	null`
`atbashReason`	`string	null`
`atbashToolCallId`	`string	null`
`atbashConfidence`	`number	null`

Parameter	Type	Description
`client`	`Atbash`	A constructed `Atbash` instance (e.g. `new Atbash(privkey)`)

Verdict	Meaning	Graph behavior
`ALLOW`	Safe to proceed, and `allow` is not `false`	Routes to `tools` node
`SKIP`	Nothing pending to judge	Routes to `END` — never to `tools`
`HOLD`	Needs human review	Graph interrupts; resume with `Command({ resume: "approve" })`
`BLOCK`	Policy violation	Injects blocked `ToolMessage`; routes back to `agent`
`ERROR`	Judge unreachable	Treated as `BLOCK` — fail closed
anything else	Unrecognised, malformed, or tampered decision	Treated as — fail closed

ts
import { Command, isInterrupted } from "@langchain/langgraph";

const result = await app.invoke(input, config);

if (isInterrupted(result)) {
  const payload = result.__interrupt__[0]?.value;
  // show payload to operator ...

  const approved = await app.invoke(
    new Command({ resume: "approve" }),
    config,
  );
}

Variable	Required	Description
`ATBASH_AGENT_PRIVKEY`	Yes (if not passing `privkey` in opts)	Your Atbash agent private key
`ATBASH_ENDPOINT`	No	Passed via `opts.endpoint` — the builder does not read this env var automatically

bash
npm install && npm run build
ATBASH_AGENT_PRIVKEY=your_key_here node examples/langgraph-runtime-agent/run.mjs

npm install @atbash/atbash-eliza

Variable	Required	Description
`ATBASH_AGENT_PRIVKEY`	Yes	Used to derive the Atbash agent identity and sign requests.
`ATBASH_ENDPOINT`	No	Overrides the default Atbash API endpoint. Passed as `judge: { endpoint }` — the SDK's trusted-endpoint policy is applied at startup.
`ATBASH_ORG_NAME`	No	Resolves which chain the agent lives on. Applied to both the judge client and the memory guard. Without it, the SDK's default chain is used.
`ATBASH_AUTO_GUARD_ALL_ACTIONS`	No	When `true` (the default), every action registered in the runtime is wrapped with the Atbash guard at startup. Set to `false` to disable and guard only actions you wrap manually with `withAtbashGuard`.
`ATBASH_REQUIRE_RECEIPT`	No	When `true` (the default), the guard blocks an action if the judge response does not include a `toolCallId` receipt. Set to `false` only for testing.

ts
import { withAtbashGuard } from "@atbash/atbash-eliza";

export const sendFundsAction = {
  name: "SEND_FUNDS",
  description: "Send funds to an external destination",
  validate: async () => true,
  handler: withAtbashGuard(async (_runtime, message) => {
    await submitTransfer(message);
    return { success: true, text: "Transfer submitted" };
  }),
};

bash
npm run build
ATBASH_AGENT_PRIVKEY=your_key_here npm run example

bash
ATBASH_AGENT_PRIVKEY=your_key_here ATBASH_ORG_NAME=your_org ATBASH_ENDPOINT=https://atbash.ai npm run example

BLOCK

Atbash-Ai/atbash-chatgpt-plugin

1. Install from the marketplace

Atbash-Ai/atbash-claude-plugin

1. Install from the marketplace

@atbash/atbash-openclaw

@atbash/atbash-autogen

Installation

atbash-hermes-plugin

@atbash/atbash-mcp

Installation

@atbash/atbash-langchain

Installation

@atbash/atbash-langgraph

Installation

@atbash/atbash-eliza

Installation

2. Set up through Connect Atbash

3. Register and trust the hook

4. Verify enforcement

Updates and development installs

2. Set up through Connect Atbash

3. Check the hook and agent status

4. Verify enforcement

Updates and development installs

Install

Get an agent key

Configure it in OpenClaw

Config fields

Hooks fields

A note on the entry name

Updating

Uninstalling

Secret redaction

Troubleshooting

License

Environment variables

When to use it

Quick start

API

judgeForAutoGen(input, client, guardManager?)

AutoGenJudgeInput

Decision

Verdict handling

Memory guard

Creating the client

Shutdown

What this package does not do

Example

Install

Update

Uninstall

Configure

Optional settings

Confirm Hermes sees it

Verdict behaviour

Docker

Tool classification

Telemetry

Troubleshooting

When to use it

Quick start

Claude Desktop

Any MCP client

Environment variables

Tools

Safety tools

atbash_judge

atbash_log

atbash_check_agent

atbash_judgment_status

Query tools (read-only)

Prompt

atbash_safety_check

Verdict handling

Enforcement is advisory in MCP

Sending better inputs

Example

When to use it

Quick start

API

`Atbash-Ai/atbash-chatgpt-plugin`

`Atbash-Ai/atbash-claude-plugin`

`@atbash/atbash-openclaw`

`@atbash/atbash-autogen`

`atbash-hermes-plugin`

`@atbash/atbash-mcp`

`@atbash/atbash-langchain`

`@atbash/atbash-langgraph`

`@atbash/atbash-eliza`

`judgeForAutoGen(input, client, guardManager?)`

`AutoGenJudgeInput`

`Decision`

`atbash_judge`

`atbash_log`

`atbash_check_agent`

`atbash_judgment_status`

`atbash_safety_check`

`withAtbashGuard(tool, client, guardManager?)`

`createAtbashGuardManager(client, opts?)`

`AtbashGuardError`

`addAtbashSafety(builder, opts)`

`createGuardNode(opts)`

`createAuditNode(opts)`

`AtbashStateAnnotation`

`createJudgeTool(client)`