SINT Protocol

Open-source runtime security and governance for AI agents, MCP tools, robotics, industrial automation, and physical AI.

Mission Authority: SINT also provides a hardware-agnostic authority and evidence protocol for autonomous air, ground, maritime, and robotic systems. It binds platform identity, mission scope, operator authorization, abort behavior, and signed after-action evidence without selecting targets or generating effects. See docs/mission-authority.md.

SINT Protocol is an open protocol and TypeScript reference stack that sits between AI agent intent and real-world execution. Before a governed tool call, robot command, industrial write, payment-like action, or actuator movement can run, the request passes through PolicyGateway.intercept() for capability-token authorization, T0-T3 approval tiering, physical constraint enforcement, revocation checks, and tamper-evident evidence logging.

What is SINT Protocol?

SINT is an AI agent security control plane for actions with real-world consequence. It helps teams answer four questions before an autonomous system acts:

• Who is allowed to act? Ed25519 capability tokens bind issuer, subject, resource, action, expiry, constraints, and delegation chain.
• What constraints apply? Velocity, force, geofence, budget, rate-limit, and consent constraints travel with the token instead of living in ad hoc config.
• When is human review required? T0-T3 approval tiers route low-risk actions automatically and escalate physical or irreversible actions to operators.
• How do you prove what happened? Every decision can be written to a SHA-256 hash-chained EvidenceLedger with portable proof receipts.

Where SINT Fits

SINT is not a replacement for MCP, A2A, ROS 2, MAVLink, MQTT, OPC UA, Open-RMF, or industrial robot tooling. It is the enforcement layer in front of those systems:

• MCP security: authorize tool calls before an MCP server executes them.
• Agent runtime governance: add pre-tool authorization, typed deny/escalate outcomes, and evidence references to agent frameworks.
• Robotics and drones: enforce ROS 2, MAVLink, PX4, and fleet actions with physical constraints and e-stop semantics.
• Industrial automation: govern OPC UA, MQTT/Sparkplug, SRCI, simulator, and offline robot-program paths before PLC or robot actions touch equipment.
• Consumer and regulated data: apply consent, caregiver delegation, differential privacy, and audit exports for smart-home and health workflows.

Latest Implementation Highlights

• Installable MCP proxy: npx -y sint-mcp --stdio runs the security-first multi-MCP proxy.
• Industrial humanoid shipyard safety: executable conformance fixtures now cover Persona-style shipyard humanoid welding, hot-work permits, fire watch, fume extraction, confined-space gas safety, bystander escalation, simulation-to-execution drift, material load envelopes, and unconditional e-stop rollback.
• Shipyard bridge and evidence scaffolding: ROS 2 weld-start profile helpers, OPC UA safety-signal mappings, Isaac Sim receipt stubs, and sintctl shipyard evidence export generate hash-chained JSONL evidence for supervisor review, remote survey support, and incident reconstruction.
• Agent commerce governance: the Economic Layer now includes a conformance profile for agent-to-agent task markets: task creation, bids, worker selection, benchmark-proof submission, settlement release, and x402-style payment permits.
• Five-minute interceptor demo: pnpm run demo:interceptor-quickstart shows request -> decision -> receipt and the fail-closed path.
• Production gateway posture: production mode requires durable stores, explicit authentication, readiness checks, and signature enforcement.
• Industrial action pack: pnpm run demo:factory-action and pnpm run demo:industrial-pack verify deny, escalate, approve, simulate, and receipt-chain flows before vendor adapter execution.
• Autonomy supervisor: @pshkv/autonomy-supervisor adds an authority lane for managed autonomy: stable -> metacognitive_recovery -> assisted_recovery -> regulated_control.
• External evidence packets: OWASP Agentic AI landscape, MITRE ATLAS candidate mappings, AAIF RFC-001 packet, NIST bundle, dependency review, and production-slice validation artifacts are published under docs/.

Academic and compliance grounding: SINT is designed with reference to IEC 62443 FR1-FR7, EU AI Act Article 13, and NIST AI RMF. The evaluation framework references the ROSClaw empirical safety study (arXiv:2603.26997) and MCP security analysis (arXiv:2601.17549).

Agent ──► SINT Bridge ──► Policy Gateway ──► Allow / Deny / Escalate
                               │
                       Evidence Ledger (SHA-256 hash-chained)
                               │
                    ProofReceipt (pluggable attestation)

Install the MCP server

The installable server entrypoint is sint-mcp.

npx -y sint-mcp --stdio
npx -y sint-mcp --config ./sint-mcp.config.example.json --stdio

If you prefer containers, build and run the repo root Dockerfile:

docker build -t sint-mcp .
docker run --rm -i sint-mcp

Try the interceptor flagship in 5 minutes

If you want the fastest builder-facing path into the SEP-1763 interceptor work:

pnpm install
pnpm run build
pnpm run demo:interceptor-quickstart

That walkthrough shows the full flagship loop in one terminal transcript:

• MCP-style request enters the interceptor
• SINT returns allow or escalate
• an audit receipt is generated for the allowed path
• execution fail-closes when a gate prerequisite is missing

Start here:

• docs/guides/sint-pdp-interceptor-quickstart.md
• packages/sint-pdp-interceptor

Production-Ready Core

For production deployments, SINT now fails closed unless the gateway is started with durable stores and explicit authentication:

SINT_ENV=production
SINT_STORE=postgres
SINT_CACHE=redis
DATABASE_URL=postgresql://...
REDIS_URL=redis://...
SINT_API_KEY=...
SINT_REQUIRE_SIGNATURES=true
SINT_WS_ALLOW_QUERY_API_KEY=false

Use /v1/ready as the orchestration health gate; it verifies the configured store and cache, while /v1/health only proves the process is alive.

Production references:

• docs/guides/gateway-production-hardening.md
• docs/guides/production-slice-verification.md
• docs/guides/docker-deployment.md

Why SINT?

AI agents now execute code, call tools, move money, operate robots, control smart-home devices, and interact with industrial systems. The risk is no longer only prompt quality; it is whether the runtime has a verifiable control point between "the model decided" and "the world changed."

SINT makes that control point explicit. It turns agent execution into a governed workflow with scoped authority, pre-action policy evaluation, operator review, physical limits, revocation, and audit evidence.

Capability Coverage

SINT is designed for physical AI and regulated data workflows where actions can be irreversible: robots, drones, smart homes, health fabric, industrial control, and critical infrastructure. Microsoft AGT focuses on digital/software governance patterns; SINT focuses on pre-action enforcement across tool, robotics, and industrial execution boundaries.