The Californer - Vindicara Launches the First Open-Source Runtime Security Platform for AI Agents

Trending...

Project AIR delivers 14 security detectors, cryptographically signed forensic records, and a four-layer trust architecture, MIT-licensed on PyPI

LOS ANGELES - Californer -- LOS ANGELES, Vindicara, Inc. today announced the general availability of Project AIR, an open-source runtime security platform purpose-built for AI agents. The MIT-licensed SDK and CLI are live on PyPI and installable with a single command: pip install projectair.

AI agents are being deployed across enterprises at scale, yet runtime security remains an afterthought. Existing tools monitor model inputs and outputs but ignore the agent itself: the tools it calls, the decisions it makes, the data it exfiltrates. Project AIR closes that gap by recording every agent action as a cryptographically signed forensic record, called a Signed Intent Capsule, then running real-time detection and producing audit-ready evidence.

Project AIR ships with 14 security detectors covering all 10 categories of the OWASP Top 10 for Agentic Applications (ASI01 through ASI10), three categories from the OWASP Top 10 for LLM Applications (prompt injection, sensitive information disclosure, model denial of service), and one chain-integrity check native to the platform.

More on The Californer

The platform is built on a four-layer trust architecture. Layer 1 anchors forensic chains to public transparency logs (Sigstore Rekor and RFC 3161 timestamp authorities) so evidence is independently verifiable with zero Vindicara API calls. Layer 2 provides automated causal reasoning across agent actions. Layer 3 integrates with Auth0 for human-in-the-loop containment when an agent attempts a high-risk action. Layer 4 extends the signed chain of custody across agent-to-agent handoffs.

"Security teams have flight recorders for servers, networks, and endpoints, but nothing for the AI agents making autonomous decisions on their behalf," said Kevin Minn, founder of Vindicara. "Project AIR gives every agent deployment a tamper-evident, cryptographically verifiable chain of custody from the first LLM call to the last tool invocation." Project AIR supports LangChain, OpenAI, Anthropic, Google Gemini, Google ADK, LlamaIndex, and any OpenAI-compatible endpoint including NVIDIA NIM. It is available now at https://pypi.org/project/projectair/ and documented at https://vindicara.io.