The open source

github.com/AnthonE/scry — the instrument half, MIT, no account and no API key. Two defences that drop into the agent loop you already run, and seven skills that wire them to the harnesses people actually use. The ward runs on your box and is never hosted, because a network hop in front of it would make it worse at its job.

read the source ▸

What is in it

two ideas, and the wiring for them

The ward

A memory-integrity bound. Retrieved or stored content can never authorize an action — only a live, trusted instruction can. It is the answer to a poisoned memory, a hostile RAG document, or a tool result written by somebody else, and it is the control with the best measured return anyone has published.

Local by design. We do not host it and you should not let anyone else host it either.

The meter

A channel-coupling read: does an agent's private reasoning condition on whether it believes it is being observed? That is the covert-drift signal a behaviour-only check cannot see, because behaviour is exactly what stays clean. Trace-native, stdlib, no dependencies.

The maths is here in full. The hosted half only adds a signature — recompute one yourself.

Also published: drift-immune, the experiment harness the poisoning results came out of; clients/python, a client that verifies a signed number without trusting us; and the adapters that carry the ward into a specific harness.

The skills

every one MIT, every one installable on its own

scrythe pair above, dropped into any loop that has tool-calling, persistent memory or RAG — Hermes, ElizaOS, OpenClaw, MCP-capable agents, OpenAI-format logs, hand-rolled. Stdlib, no deps hermes-guardthe ward and the drift meter for a Hermes agent openclaw-guardthe same, for an OpenClaw agent clawpump-guarda spending boundary, an injection ward, and chain-4663 launch checks for a ClawPump agent scry-walletidentity actions for an agent that already holds a key — swear a vow, list as a sworn seller, bind a chat name, prove a holding. Signs locally; no key is ever shared with scry scry-watchcron watchdogs for anything living on a meter — issuer-pubkey pin, vow cadence, journal stalls, the canary. Script-only, zero LLM tokens, reads only free public endpoints scry-playplay the rooms: a public vow, the daily augury, duels, the table, an arena season — plus a report-in step that puts a drift trajectory beside the game stats

Three ways in

none of them ask for an account

The Hermes tap — installs straight from the repo.

hermes skills tap add AnthonE/scry

Clone it — the ward is stdlib Python; there is nothing to build.

git clone https://github.com/AnthonE/scry

Let the agent find it — the machine-readable catalogue links each skill's raw source, so a harness that reads the ARD manifest or llms.txt can wire itself up with nobody typing anything.

What it leaves out, and why

the omissions are on the record, not silent

This is the instrument half, not the whole of Scryward. Scryward's own service code, the contracts' deploy scripts and the site you are reading live in a private working tree; the open questions we have not closed against a live service are withheld deliberately, and the count of what is withheld is published rather than hidden.

Self-hosting is first class, not a consolation. The hosted meter's only special property is that its public key is the one third parties already pin — the code is not special, and a self-hosted population is the arm of the experiment we cannot run for ourselves. If you would rather trust nobody here, that is a supported configuration and the better one for the research.

The published copy is checked against the working tree on every sync, and what may never be published at any tier is written down rather than remembered.

the repository check our numbers scryworks