Countersign

Countersign

[](https://pypi.org/project/countersign-agent/) [](https://github.com/cyberbobas/countersign/actions/workflows/tests.yml) [](https://pypi.org/project/countersign-agent/) [](LICENSE)

Your AI coding agent asks "can I run this?", but the agent itself draws that dialog. So it can pad it, fake a "security review", and bury the one line that actually matters. Countersign draws the dialog for you, from the exact command that will run. You approve the real thing, and every yes becomes a receipt in a tamper-proof ledger.


Part of [Agentoffense](https://agentoffense.com), the companion to [Airlock](https://github.com/cyberbobas/airlock). Airlock is the policy firewall (what a call may do). Countersign is the honest human yes (proof that you approved the real call).

pip install countersign-agent
countersign demo      # or: csign demo

What it closes

Four gaps a path firewall does not:

#	gap	command
1	Honest HITL / LITL: you sign the argv, not the agent's story	countersign askd · countersign approvers · countersign quorum
2	Census of hidden skills: hold every instruction file you did not pin	countersign census --deny-new
3	MCP sampling / elicitation / roots deny, both directions of the pipe	countersign-mcp
4	Inbound fence: a stranger's mail or issue is data, tools frozen	countersign inbound --from email
5	Receipts: the ledger of consents is hash-chained and checkable	countersign verify · countersign replay

Not a path firewall. Injection can still *ask*. I