Salient Core — AI skill for Claude Code

salient-core

**A permission layer that runs *below* the model, not in its prompt.** Every tool call — SDK built-in, MCP, inter-agent bus, or one the model tries to slip through as plain text — hits the same default-deny gate before it executes. A denied call never runs.

[](https://github.com/baggybin/salient-core/actions/workflows/ci.yml) [](https://github.com/baggybin/salient-core/blob/main/LICENSE)

One developer, pre-alpha (`0.8.27`), not yet on PyPI, APIs still moving. 1143 tests. The control model was forged inside a private multi-agent security system, where the gates had to hold under real pressure — then it generalized out to this. Apache-2.0.


---

Most stacks secure agents with a system prompt: *"don't touch production,"* *"don't delete that folder."* That's a request, not a wall. If the model hallucinates, gets prompt-injected, or is just over-eager, nothing underneath the loop stops the destructive call — it runs. An agent that can still run `rm -rf` because a prompt asked it not to isn't sandboxed; it's hoping.

`salient-core` moves the rule out of the prompt and into the call path. It sits between the model and your tools as a default-deny kernel: every invocation is classified and checked *before* anything executes, the decision is recorded, and anything a human needs to approve waits in a typed inbox. Enabling a tool never implicitly authorizes it — capability and authorization are separate, and unclassified tools fail closed.

The one thing a prompt-level guardrail can't do

The gate keys off a *canonical* identity, not the wire name the model chose — so a call can't rename itself, or switch transports, to dodge the rule. Here the same po