Brackoracle

What is BrackOracle?

BrackOracle is a runtime security oracle for AI agents that scans prompts, tool calls, and outputs before execution. Every decision is HMAC-SHA256 signed and written to an append-only audit log for cryptographic verification. Designed for autonomous agents and compatible with OpenClaw.

How to use BrackOracle?

Call POST /v2/scan with a JSON body containing the content to scan, optionally including the X-Free-Tier: AGENTFAST header for free tier access. Use the Python SDK via BrackClient for programmatic integration. Paid tier uses x402 micropayments via USDC on Base—no accounts, API keys, or subscriptions needed.

Key features of BrackOracle

• HMAC-SHA256 signed, append-only audit log
• Hash-only logging; raw prompts are never stored
• 13+ specialist endpoints for specific detection tasks
• Zoa cognitive blindspot audit with four independent faculties
• Prompt lineage tracking for multi-agent contamination
• Self-hostable under Apache 2.0 license

Use cases of BrackOracle

• Detect prompt injections and jailbreak attempts before LLM reasoning
• Validate tool calls against scope escalation and trust laundering
• Scan agent outputs for secret leakage before publishing
• Audit cognitive blindspots in agent reasoning with Zoa
• Track injection contamination across multi-agent pipelines

FAQ from BrackOracle

What is the free tier?

The first 200 calls per IP are free when using the X-Free-Tier: AGENTFAST header—no account required.

Are raw prompts stored anywhere?

No. BrackOracle uses hash-only logging throughout the system; raw prompt content is never persisted.

How can I verify a decision cryptographically?

Call GET /audit/verify/:id to retrieve and verify the HMAC signature for any request row.

Can I self-host BrackOracle?

Yes, the Apache 2.0–licensed codebase runs on a single N100 mini PC with Node.js and Python FastAPI services.

How does payment work?

Paid usage uses x402 micropayments in USDC on Base—agents pay autonomously without accounts or API keys.