SecureToolKit is a Swift 6 library that evaluates deterministic security rules between an untrusted model-generated tool proposal and a Host-owned tool.
The Host is the application integrating SecureToolKit: for example, a backend service, desktop app, CLI, or local AI runtime. It owns model access, authentication, trusted time, durable single-use Consumption, storage, and Execution. SecureToolKit is the library the Host calls to construct and validate bounded evidence. See the responsibility matrix.
Agent frameworks coordinate models, plans, memory, tools, and loops. SecureToolKit does not plan tasks, call models, select prompts, run tools, or manage an agent loop. It supplies a separate fail-closed authorization boundary that an agent Host may call before any side effect.
No. Model output is always untrusted. Authority must originate from authenticated Host context and pass exact deterministic checks.
Traditional authorization commonly starts with an authenticated principal and a known operation. LLM applications must first establish what tool and arguments were actually proposed, how untrusted content influenced them, and whether they match reviewed schemas, intent, policy, and Host authority. SecureToolKit makes those bindings explicit before Authorization can exist.
OAuth is a framework for delegated access. It can help a Host obtain an access token and bounded scopes, but it does not establish that model-proposed tool arguments match authenticated intent, reviewed schema, provenance, policy, and human confirmation. SecureToolKit can use Host-authenticated context alongside OAuth-based systems; it does not replace OAuth or issue access tokens.
RBAC and ABAC answer whether a principal with particular roles or attributes may perform an operation. SecureToolKit addresses how an AI-proposed operation becomes an exact reviewed operation in the first place. A Host can incorporate RBAC or ABAC outcomes into its authenticated authority and policy design while retaining SecureToolKit's exact proposal bindings.
The Model Context Protocol standardizes how applications expose context and tools to models. That interoperability layer does not make model output trusted or decide whether a proposed side effect is authorized. SecureToolKit can sit between an MCP-derived proposal and a Host-owned tool executor.
Tool-calling APIs provide structured proposal transport. Structure alone does not prove identity, intent, provenance, policy eligibility, confirmation, or single use. SecureToolKit is provider-neutral and can validate a Host-parsed proposal after any model SDK has produced it.
No. Execution is permanently outside the library. The Host validates evidence, atomically consumes the relevant identity, and invokes its own executor.
No. Validation is pure, repeatable, and non-consuming. Atomic single use is a mandatory Host contract and is not implemented as storage in this package.
The core remains deterministic and platform-neutral. Storage introduces deployment-specific durability, confidentiality, consistency, availability, and recovery decisions that the Host must own. SecureToolKit does not silently claim those properties through an in-memory or default persistence layer.
Pure Validation must be repeatable: equal inputs produce equal results and do not mutate state. The protocol supplies exact replay and Consumption identities for a Host-owned durable atomic store. Until that Host operation succeeds, no side effect should execute.
No. Phase 7 defines deterministic confirmation evidence and bindings. UI, localization, biometrics, authentication mechanisms, and platform adapters are Host responsibilities.
No. Authentication evidence cannot substitute for Confirmation Authority or an explicit affirmative response bound to the exact challenge.
No production-readiness approval is claimed. A production Host still needs trusted time, cryptographic authenticity where required, durable replay and atomic Consumption controls, revocation, audit persistence, executor binding, operations, and deployment controls.
The package declares macOS 13, iOS 16, tvOS 16, watchOS 9, and visionOS 1 and uses Swift 6 language mode. Linux is supported through Swift Package Manager. Only platforms with current release evidence should be described as validated.
No. The Swift package currently has no third-party package dependencies.
Read the README, security model, architecture, and documentation index. Integration examples are under Examples.
Follow SECURITY.md. Never post exploit details, secrets, customer data, or raw prompts in a public issue.