> ## Content Index
> Fetch the complete content index at: https://www.stirup.si/llms.txt
> Use this file to discover other available public pages before exploring further.

# Show HN: DeadBolt – a local execution gate for agent tool calls
- URL: https://www.stirup.si/show-hn-deadbolt-a-local-execution-gate-for-agent-tool-calls-d042e7cf/
- Published: 2026-10-11T21:01:14.000Z
- Updated: 2026-10-11T21:01:14.000Z
- Description: DeadBolt is a local execution gate for software agents, designed to enforce policy and operator controls before allowing actions to proceed. It supports integration with Rust, HTTP, and stdio MCP, and includes features like policy enforcement, operator revocation, and structured evidence. This analy
- Author: Satish Das
- Tags: Community, Stirup Research

## Overview of DeadBolt

DeadBolt is described as a local execution gate for software agents, designed to act as a control point before allowing actions to proceed. It is implemented in Rust and supports integration with HTTP and stdio MCP (Machine Communication Protocol). The tool is intended to be embedded in applications, used as a local sidecar, or wrapped around a trusted stdio MCP server. It is released under the Apache-2.0 license and is available as a native executable for multiple platforms, including Linux, Windows, and macOS.

## Key Features and Integration Options

DeadBolt provides several integration options depending on the application's needs. For Rust applications, it can be embedded as a single dependency with an embedded store and a check at dispatch. For Python applications, it can be used as a local sidecar with dispatch around the actual function. It also supports integration with the OpenAI Agents SDK, allowing the use of a local sidecar and the @protected\_tool decorator on each protected function. For other languages like Node.js, it can be used as a local sidecar with a bundled Node client or via the HTTP protocol. Additionally, it can replace the launch command of a trusted stdio MCP server with a DeadBolt proxy.

## Policy and Control Mechanisms

DeadBolt supports policy enforcement, operator revocation, and structured evidence. It includes features such as leases with a default 60-second sliding TTL, operator kill blocks, and broad one-shot approvals for classified irreversible tools. It also allows for the review of exact arguments, including recipient, body, and amount. The tool uses SQLite for evidence storage, JSONL mirrors, and per-agent incident exports. It defaults to denial when the store is unavailable and denies on transport failure, malformed responses, or unsuccessful HTTP status codes.

## Limitations and Trust Boundaries

DeadBolt is designed to protect actions routed through the executor, but it does not isolate arbitrary code, stop a model provider, cancel a running body, or make an external effect transactional with admission. The MCP child is trusted and has OS access, and startup and non-tool MCP methods are outside the tool-call gate. Evidence hashes identify content, but operator-writable records are not a compliance certification. Users are advised to read trust boundaries before deployment and use the pilot checklist to verify actual routes.

## Installation and Evaluation

DeadBolt is available as a native executable for Linux x86\_64, Windows x86\_64, Apple Silicon, and Intel Macs. It can be installed via the v1.0.3 release, which includes native ZIPs. Evaluation can be performed using the provided Python examples, which start a private sidecar, write harmless temporary files, and clean up afterward. The evaluation requires Python 3.9+ and produces a JSON report with a "passed": true result if successful.

## Developer Documentation and Testing

Developer documentation includes a quick start guide, installation instructions, integration details, and troubleshooting. It also covers deployment, backup, and response operations. Technical briefs and contributing guidelines are available, along with a changelog and release procedure. Testing includes cargo test, cargo clippy, and Python tests. However, passing these checks does not establish acceptance of the application, and users are advised to report bugs or use private security reporting for issues.

**Source:** [Hacker News Show](https://github.com/seanebones-lang/deadbolt?ref=stirup.si). Analysis based on publicly available information; no hands-on testing is claimed.