HushSpec is an open specification designed to declare security rules for AI agents at the boundary where they interact with external tools and systems. It provides a portable, engine-neutral rule language that specifies what an agent may access, invoke, or transmit, allowing developers to define which interactions are allowed, blocked, or require confirmation across diverse runtimes, frameworks, and programming languages. The specification focuses on declarative policy, separating the definition of security boundaries from their enforcement, which is handled by conforming engines.
The rule language in HushSpec consists of ten distinct rule types, each resolving to one of three decisions: allow, warn, or deny. These rules cover areas such as blocking access to sensitive filesystem paths, allowlist-based access control, network egress by domain, detection of secrets in file content, validation of patch integrity, blocking dangerous shell commands, controlling tool and MCP invocations, monitoring computer use agent actions, managing remote desktop side channels, and controlling input injection capabilities. The rules are stateless, purely declarative, and do not involve runtime state or detection algorithms, ensuring portability and clarity.
HushSpec provides SDKs in Rust, TypeScript, Python, and Go, each implementing the full evaluation pipeline for policies. These SDKs include features such as parsing, validation, merging, resolution, evaluation, auditing, and detection helpers. The Rust SDK serves as the reference implementation and uniquely supports Ed25519 signing, while TypeScript and Python offer additional adapters and observer layers. Runtime integrations vary by language, but the decision model remains consistent across all SDKs.
A command-line tool, h2h, supports the entire policy lifecycle, offering subcommands for validating, testing, linting, diffing, formatting, auditing, and signing policy documents, as well as emergency controls and key management. HushSpec also includes seven built-in profiles for common deployment scenarios, such as balanced security, strict lockdown, development-friendly settings, AI coding assistants, CI/CD pipelines, remote desktop sessions, and emergency deny-all modes. Optional modules extend the core with features like state machines, origin-aware profiles, and detection thresholds for advanced use cases.
0 license, and its documentation, SDKs, and command-line tooling are accessible for developers aiming to secure AI agent interactions in a portable and standardized way.
HushSpec sits in PulseGate's Security & compliance platforms category. It focuses on standardizing and enforcing security boundaries for AI agent tool interactions across runtimes and frameworks. It is built as an open-source project for AI agent framework developers. HushSpec is open source under the Apache-2.0 license. It runs on the web, the command line, and API, and it can be self-hosted.
HushSpec first shipped in 2026. Development happens publicly on GitHub with 25 stars and 1 commits in the last 90 days. Key capabilities include policy declaration, spec validation, and engine-neutral. It exposes integrations via an MCP server.
Latest indexed changes and source events
Other apps tracked under the same category.
