An AI agent is an untrusted program handling adversarial input. corral assumes the model is already compromised, fuzzes its tool-use boundary to find exactly where that boundary breaks — then ships the runtime layer that holds it shut. Think Nessus, but for agents.
Prompt-injection and jailbreaks mean you can't trust what an LLM decides to do with its tools. corral stops arguing about whether the model is safe and instead pins down what its tools are allowed to do — then proves the boundary both by attacking it and by enforcing it.
Searches over typed attack plans against your tool loop. The oracle compares intended policy to what actually executed — surfacing every place the agent stepped outside the lines.
A deployable runtime reference monitor. Wrap a real tool loop in ~10 lines; it fails closed and is stricter-or-equal to the oracle by construction — the fuzzer can't find what the kernel can't allow.
Unauthorized tool, confused deputy, argument-constraint escape, taint egress, out-of-sequence, and rate/budget abuse — the ways an agent's tool use actually goes wrong.
Proven as middleware on real pydantic-ai and LangGraph loops — same StateGraph, same tools: the developer guard leaks, the kernel reports zero escapes.
Write policy in YAML/JSON — host allowlists, path roots, numeric ranges, command allowlists, enums, sequencing and budgets. Validate, lint, and scaffold from a recorded trace.
Already have an agent? Record a trace and run the same oracle over it — no adapter, any framework. Get an HTML report, SARIF for code-scanning, and a CI regression gate.
Point corral's fuzzer at a naive agent and it finds the escapes. Wrap that identical agent — same dangerous tools — in the Confinement Kernel and re-fuzz: zero findings. Not a promise, a demonstration you can reproduce.
It's been battle-tested against a zoo of realistic agents — support, SRE, commerce, banking, healthcare copilots — each with planted SSRF, command-injection, path-traversal, negative-charge and taint-laundering bugs. The fuzzer finds every one; kernel mode contains every one.
Ships as a corral-fuzz wheel, standalone Linux/Windows binaries, and a multi-arch container — provisioned to early-access partners. No heavy dependencies for the core.
A reusable GitHub Action runs, scans and diffs on every push, uploads SARIF to code-scanning, and fails the build on a new containment finding.
A deployed kernel reports what it contained — denials by guard site, audit log, and a self-contained operator dashboard. You can see the boundary holding.
corral is the layer between your LLM's decisions and your systems. Get early access, or talk through hardening the agent you're already shipping.