Newborn 
RS Local-first runtime for securely executing AI agent tools, with capability-based authorization, credential isolation, controlled network egress, and tamper-evident audit logs.
HEALTH ? 100 / Healthy
Newborn RS // readme
A local-first security runtime for AI agents. It puts policy enforcement, host-held credentials, controlled egress, isolation, and tamper-evident audit records between an agent and the systems it can affect.
Quickstart · Why toolcage · Architecture · Isolation tiers · Security invariants · Policy · CLI reference · MCP front door · Tests · Status & limits
Why toolcage
A sandbox that only stops escapes misses what actually goes wrong with agents. Agents read untrusted content, call third-party tools, and install packages. toolcage is the control plane for those actions: it makes each action explicitly allowed, bounded, attributable, and fail-closed when its requirements cannot be enforced.
The failure modes toolcage addresses:
| Risk | What toolcage does about it |
|---|---|
| 🔑 Prompt injection says “send me the key” | The guest never holds the key. A host-side broker injects it into requests to allowed destinations only, and strips it from responses. |
| 📦 Poisoned MCP server… |