VIGIL
An AI Agent runtime firewall based on a graph database. It intercepts cross-session data leakage through the PreToolUse hook or an MCP server and supports four decisions: allow, ask, deny, and rewrite.
Timeline (last 90 days)
VIGIL is a runtime firewall backed by the graph database FalkorDB, deployed in front of AI Agent tools, and can serve as a PreToolUse hook for Claude Code or run as an MCP server.
VIGIL has four kinds of output results: allow, ask (requires human approval), deny, and rewrite (modify dangerous parameters and then let through).
The VIGIL project contains 68 decision-related queries, all validated on FalkorDB 6.0.2, with a median graph database time per decision of 0.71 milliseconds and a p99 of 2.69 milliseconds.
VIGIL's core graph model is (:Session)-[:MADE]->(:Call)-[:READ]->(:Value) and (:Call)-[:ARG_CONTAINS]->(:Value), and values matching secret key rules are hashed before being stored on Value nodes, with the keys themselves never entering the graph.
VIGIL uses the max-flow min-cut theorem to turn security decisions into min-cut cost computation, assigning capacity 2 to argument edges and capacity 2n−1 to the call edge (n being the number of arguments), with the max flow return value directly encoding the decision: 0 for allow, 2k for rewrite, 2n−1 for block.
For arguments carrying a destination (such as url, host, endpoint), VIGIL assigns infinite capacity to the corresponding edge, so that as long as the destination is tainted the cut must occur at the call level, i.e., a direct block.
In a real case, the Claude Code hook returned a rewrite result for a DNS update, with the txt in updatedInput replaced by [REDACTED by VIGIL]; when every argument carries a sensitive value, the min-cut cost becomes 3 and the entire call is blocked.
In the removal test, all six attack scenarios were blocked or handled when graph context was available, while the control server returned "no opinion" for all six scenarios when the graph was unavailable; the author explicitly states that this is not a general security benchmark and that six scenarios are insufficient to establish a general detection rate.
All Facts (8)
In the removal test, all six attack scenarios were blocked or handled when graph context was available, while the control server returned "no opinion" for all six scenarios when the graph was unavailable; the author explicitly states that this is not a general security benchmark and that six scenarios are insufficient to establish a general detection rate.
50%UnverifiedVIGIL has four kinds of output results: allow, ask (requires human approval), deny, and rewrite (modify dangerous parameters and then let through).
50%UnverifiedThe VIGIL project contains 68 decision-related queries, all validated on FalkorDB 6.0.2, with a median graph database time per decision of 0.71 milliseconds and a p99 of 2.69 milliseconds.
50%UnverifiedVIGIL's core graph model is (:Session)-[:MADE]->(:Call)-[:READ]->(:Value) and (:Call)-[:ARG_CONTAINS]->(:Value), and values matching secret key rules are hashed before being stored on Value nodes, with the keys themselves never entering the graph.
50%UnverifiedVIGIL uses the max-flow min-cut theorem to turn security decisions into min-cut cost computation, assigning capacity 2 to argument edges and capacity 2n−1 to the call edge (n being the number of arguments), with the max flow return value directly encoding the decision: 0 for allow, 2k for rewrite, 2n−1 for block.
50%UnverifiedFor arguments carrying a destination (such as url, host, endpoint), VIGIL assigns infinite capacity to the corresponding edge, so that as long as the destination is tainted the cut must occur at the call level, i.e., a direct block.
50%UnverifiedVIGIL is a runtime firewall backed by the graph database FalkorDB, deployed in front of AI Agent tools, and can serve as a PreToolUse hook for Claude Code or run as an MCP server.
50%UnverifiedIn a real case, the Claude Code hook returned a rewrite result for a DNS update, with the txt in updatedInput replaced by [REDACTED by VIGIL]; when every argument carries a sensitive value, the min-cut cost becomes 3 and the entire call is blocked.
50%