DeadBolt by NextEleven MCP server

DeadBolt

A local execution gate for software agents. Put DeadBolt in the code that runs an action, then let policy and operator controls decide whether that action runs. Embed it in Rust, call its local sidecar from another language, or wrap a trusted stdio MCP server. Free under Apache-2.0.

Keep DeadBolt state and operator controls outside untrusted agent processes.

RC2 creates private Unix state and requires reviewed permission migration for older stores; see private state. A process that can write the database or invoke the operator CLI has operator authority; socket credentials cannot contain it. For untrusted tool execution, use separate OS/service ownership and a protected dispatcher. RC2 requires operator authentication for both Unix and TCP sidecars by default. Trust boundary · HTTP setup

Download MCP bundle 1.1.0 · Try it · Install · Integrate · Project site

Evaluate the 2.0 developer candidate

Published corrected preview: engine 2.0.0-rc.2 / Python 2.0.0rc2. It adds supervisor renewal by default for fresh roots, complete ancestor policy checks, authenticated operator setup, private persisted state and model-readable denials. Existing stored renewal modes stay unchanged. Actual graphical-client acceptance and the independent rerun remain open; stable promotion is gated on them.

Download the matching engine and Python wheel. The release includes four native targets, checksums, source identity and acceptance receipts; both Mac ZIPs are signed/notarized. The Python wheel installs the client, not an engine or sidecar. Read the migration guide before upgrading.

The Homebrew preview and local MCPB RC2 are available. Use the RC2 editor helper for Cursor/VS Code. PyPI now supplies the matching 2.0.0rc2 client. Cargo remains on RC1 until its separate corrected publication is verified. Use the RC2 native download, verified GitHub wheel or immutable source tag now:

git clone --branch v2.0.0-rc.2 --depth 1 https://github.com/seanebones-lang/deadbolt.git
cd deadbolt
cargo install --path . --locked --bin deadbolt
# In your application's virtual environment:
python -m pip install 'n11-deadbolt-client==2.0.0rc2'

Try it before connecting an agent

No model account, API key, Harness, cloud service or database server is needed. The published v1.0.3 release has native ZIPs for Linux x8664, Windows x8664, Apple Silicon and Intel Macs. Verify and extract the matching archive. From its extracted directory on macOS/Linux:

chmod 0755 deadbolt
./deadbolt drill
python3 examples/evaluate.py --binary ./deadbolt

Shortened. The full README is on GitHub.