emiliaprotocol/emilia-protocol

Authority control plane for autonomous work. EMILIA Gate enforces finite customer-owned mandates at protected executor boundaries; the open protocol keeps evidence verifiable.

What it solves

EMILIA Protocol provides a security boundary for autonomous agents to prevent them from "quietly widening" their operating mandate. It solves the control problem where agents can perform consequential actions (like moving money, changing code, or altering infrastructure) without explicit, durable, and verifiable authority for each specific action.

How it works

EMILIA implements a "toll booth" (Gate) at the boundary where an agent's intent becomes a consequential action. It separates identity (who is calling) from authority (what exact work is allowed).

  1. Mandate: A human or institution defines a finite operating mandate (limits, budget, expiry).
  2. Exact Work: The system binds the method, target, and material fields of a request into a canonical executable object.
  3. Verify and Reserve: The Gate verifies the authority required for that exact action, reserves that authority before the provider is entered, and permits only one admitted provider attempt to prevent blind retries.
  4. Human Authority: When required by policy, the system can trigger a WebAuthn/passkey sign-off for a specific action.
  5. Truthful Result: It generates portable evidence (Trust Receipts) of what was admitted and observed, treating lost responses as INDETERMINATE states that require reconciliation rather than automatic retries.

Who it’s for

  • AI Agent Developers: Those building autonomous workers that need to be wrapped in a security layer to ensure they stay within bounded capabilities.
  • Enterprises: Organizations requiring durable authority state and audit trails for agent-driven financial operations or infrastructure changes.
  • Security Auditors: Users who need portable, verifiable evidence of agent actions.

Highlights

  • Preventive Control: Blocks unauthorized actions before they reach the provider credential.
  • Emergency Authority Freeze: Allows owners to stop new consequences without needing to terminate the agent's computation.
  • Causal Evidence: Uses a system of Trust Receipts and Trust Profiles to provide offline-verifiable evidence of work.
  • Causal-Action Identifier (CAID): Binds authority to the exact material fields of an action.
  • MCP Server Support: Includes a Model Context Protocol (MCP) server for easy integration with LLM tools like Claude or Cursor.

Related

  • Project
    Vasco0x4/AIDA

    AIDA is an open‑source autonomous pentesting agent that lets any LLM (Claude, Gemini, OpenAI Codex, etc.) drive a Docker‑based security testing environment. The model plans the assessment, calls built‑in tools (nmap, sqlmap, custom Python, raw HTTP), logs every step in a persistent notebook, auto‑scores findings with CVSS 4.0, and can export PDF reports. It ships with a lightweight `aida-pentest` container (or can attach Exegol for more tools) and includes a web dashboard, authentication, and notification integrations. The README cites real CVEs discovered by the system. Licensed under AGPL‑v3.

  • Project
    tophant-ai/aibeat

    A security evaluation framework for generative AI that provides evidence-based safety testing for LLMs, RAG apps, and AI agents.

  • Project
    matrixorigin/memoria

    Memoria adds Git‑like version control to AI‑agent memory, letting agents store, branch, merge, and roll back facts, preferences, and procedural steps. It provides hybrid vector/full‑text search, automatic contradiction detection, and full audit trails, and can run as a cloud service or self‑hosted with MatrixOne’s copy‑on‑write database.

  • Project
    0xSteph/pentest-ai

    pentest‑ai (ptai) is an open‑source Python CLI that uses an LLM to orchestrate a large set of security tools, then automatically re‑runs each exploit with a deterministic “oracle” to prove the vulnerability. Only findings that the oracle reproduces are marked VERIFIED and packaged as replayable proof capsules. It runs locally (no telemetry), supports offline LLMs, integrates with CI/CD, and ships benchmarks showing 12 verified findings on OWASP Juice Shop and 23 on a custom honeypot.

  • Project
    ailia-ai/ailia-models

    A curated collection of 400+ pre‑trained AI models (vision, audio, language, etc.) that can be run with a single command after installing the `ailia` Python package. It provides a uniform CLI, automatic weight download, and cross‑platform support, making it easy to prototype many state‑of‑the‑art models.