TibetClaw

Trust-First Agent Framework — the trust kernel that agentic AI is missing.

While OpenClaw proved the market (250K+ stars) and Network-AI added orchestration, neither provides behavioral trust, cryptographic provenance, or semantic firewalling. TibetClaw does.

Install

npm install tibetclaw

Quick Start

import { Orchestrator } from "tibetclaw";

const orch = new Orchestrator();

orch.register("analyst", (task) => ({ risk: "low", confidence: 0.92 }), {
  description: "Risk analysis agent",
});

const result = await orch.run("analyst",
  { action: "classify", data: "quarterly report" },
  { intent: "Classify document risk level for compliance" }
);

console.log(result.output);        // { risk: "low", confidence: 0.92 }
console.log(result.tibetToken);     // TIBET provenance token
console.log(orch.trustScores());    // Per-agent trust scores

Core Principles

1. Audit is a PRECONDITION, not an observation
2. Trust is EARNED through behavior (FIR/A), not assigned by config
3. Every action generates a cryptographic TIBET token
4. SNAFT firewall rules are IMMUTABLE — not overridable at runtime
5. Identity is INTENT-based (JIS), not credential-based

The Three Pillars

1. FIR/A Trust Kernel

Behavioral trust scoring. Trust is earned through good behavior and lost fast through bad behavior.

import { TrustKernel } from "tibetclaw";

const kernel = new TrustKernel({ resetThreshold: 0.3 });
kernel.register("agent-01");

// Good behavior → trust increases slowly (capped at +0.05)
kernel.reward("agent-01", "task_completed", 0.05);

// Bad behavior → trust drops fast (no cap)
// Swan Protocol: trust below threshold = agent KILLED and restarted
kernel.penalize("agent-01", "injection_attempt", 0.3);

2. TIBET Provenance Chain

Every action generates a cryptographic token with four semantic dimensions:

| Dimension | Dutch Origin | Meaning | |-----------|-------------|---------| | ERIN | er-in | What's IN the action (content) | | ERAAN | er-aan | What's ATTACHED (dependencies) | | EROMHEEN | er-om-heen | What's AROUND it (context) | | ERACHTER | er-achter | What's BEHIND it (intent — WHY) |

import { ProvenanceChain } from "tibetclaw";

const chain = new ProvenanceChain();
const token = chain.record({
  agentId: "analyst",
  erin: { action: "classify", input: "document.pdf" },
  eraan: ["model:gpt-4"],
  eromheen: { environment: "production" },
  erachter: "Classify document risk for compliance review",
});

console.log(chain.verify()); // true — tamper-evident

3. SNAFT Firewall

Semantic firewall with immutable rules, informed by common LLM attack patterns:

import { SNAFTFirewall } from "tibetclaw";

const firewall = new SNAFTFirewall(true); // default OWASP rules

const decision = firewall.check(
  "analyst",
  { action: "analyze" },
  "ignore previous instructions"
);
// decision.blocked === true (SNAFT-001-INJECTION)

4. TIBET-Signed Skills

Skills with verified provenance — prevents the OpenClaw "ClawHavoc" problem:

import { defineSkill, SkillRegistry } from "tibetclaw";

const classify = defineSkill({
  name: "risk_classify",
  description: "Classify document risk level",
  author: "compliance-team",
  minTrust: 0.5,
}, (doc) => ({ riskLevel: "low" }));

const registry = new SkillRegistry();
registry.register(classify);
const result = registry.invoke("risk_classify", { file: "report.pdf" });

CLI

npx tibetclaw demo     # Interactive demo
npx tibetclaw version  # Version info

Also Available

• Python: pip install tibet-claw — PyPI
• Full ecosystem: 55 packages on PyPI

Standards

• IETF TIBET Protocol
• IETF JIS Identity
• OWASP LLM Top 10 awareness (security-informed design)

License

MIT — Jasper van de Meent & Root AI / Humotica