Every tiny agent here is a free, open source TypeScript demo you can clone and run in a minute. Most use a mock model, so there is no API key to set up. Pick a failure mode, read the code, steal the guard.
tiny-harness-decision-boundary
The model proposes. The harness decides. The log remembers.
git clone https://github.com/bobbyhalljr/tiny-harness-decision-boundary.git && cd tiny-harness-decision-boundarytiny-poisoned-inbox
One poisoned email makes a naive inbox agent leak a card number. A 19-line outbound guard stops it.
git clone https://github.com/bobbyhalljr/tiny-poisoned-inbox.git && cd tiny-poisoned-inboxtiny-injection-gate
Three guards, three emails, one tool-using agent. See which one a Rule of Two gate stops.
git clone https://github.com/bobbyhalljr/tiny-injection-gate.git && cd tiny-injection-gatetiny-break-me-01
Make Polly, a polite support bot, leak her secret coupon code.
git clone https://github.com/bobbyhalljr/tiny-break-me-01.git && cd tiny-break-me-01tiny-confirm-gate
Reads pass. Mutations need a one-time confirm of the exact payload.
git clone https://github.com/bobbyhalljr/tiny-confirm-gate.git && cd tiny-confirm-gatetiny-agent-harness
Tool registry, allow/ask/deny permissions, context trimming, step budget, event log.
git clone https://github.com/bobbyhalljr/tiny-agent-harness.git && cd tiny-agent-harnesstiny-shell-gate
A shell command gate that refuses what it cannot parse.
git clone https://github.com/bobbyhalljr/tiny-shell-gate.git && cd tiny-shell-gatetiny-delegation-guard
Authority shrinks at every hop. Trust internal vs signed caller vs attenuated chain.
git clone https://github.com/bobbyhalljr/tiny-delegation-guard.git && cd tiny-delegation-guardtiny-access-grant
Lifecycle-bound access grants for registered AI agents.
git clone https://github.com/bobbyhalljr/tiny-access-grant.git && cd tiny-access-granttiny-poppy-gate
Discovery plus session scope: guest allowlist, read, write, fail closed.
git clone https://github.com/bobbyhalljr/tiny-poppy-gate.git && cd tiny-poppy-gatetiny-dots-agent
An always-on agent: events, background vs assigned mode, allow/ask/deny rules.
git clone https://github.com/bobbyhalljr/tiny-dots-agent.git && cd tiny-dots-agenttiny-decision-gate
Score only allowed answers, then act, ask or skip with thresholds in code.
git clone https://github.com/bobbyhalljr/tiny-decision-gate.git && cd tiny-decision-gatetiny-agent-mods
Middleware that rewrites prompts, blocks shell and redacts secrets, with sec-default loaded first.
git clone https://github.com/bobbyhalljr/tiny-agent-mods.git && cd tiny-agent-modstiny-shared-workspace
Pages, ACLs, optimistic concurrency and a Memory leak demo for humans and agents.
git clone https://github.com/bobbyhalljr/tiny-shared-workspace.git && cd tiny-shared-workspacetiny-credential-gateway
The sandbox holds only a short-lived token. The real credential is injected outside.
git clone https://github.com/bobbyhalljr/tiny-credential-gateway.git && cd tiny-credential-gatewaytiny-egress-policy
Denylist vs allowlist vs default deny against one scripted escape.
git clone https://github.com/bobbyhalljr/tiny-egress-policy.git && cd tiny-egress-policytiny-mcp-issuer-pin
An MCP client that pins the OAuth issuer before it fetches anything.
git clone https://github.com/bobbyhalljr/tiny-mcp-issuer-pin.git && cd tiny-mcp-issuer-pintiny-rag-revocation-gate
Cached retrieval results are references, not authorization.
git clone https://github.com/bobbyhalljr/tiny-rag-revocation-gate.git && cd tiny-rag-revocation-gatetiny-model-router
Picks the cheapest model that fits each task and pauses at a per-project spend cap.
git clone https://github.com/bobbyhalljr/tiny-model-router.git && cd tiny-model-routertiny-fanout-budget
A budget for phased multi-agent workflows that fan out cheap workers.
git clone https://github.com/bobbyhalljr/tiny-fanout-budget.git && cd tiny-fanout-budgettiny-context-compactor
Four context policies, one scripted run, input tokens counted for each.
git clone https://github.com/bobbyhalljr/tiny-context-compactor.git && cd tiny-context-compactortiny-schema-gate
Validate structured LLM output. One constrained repair. Accept or reject.
git clone https://github.com/bobbyhalljr/tiny-schema-gate.git && cd tiny-schema-gatetiny-ui-gate
Allowlist, validate, one repair, reject for model-emitted interface trees.
git clone https://github.com/bobbyhalljr/tiny-ui-gate.git && cd tiny-ui-gatetiny-agent-cancellation-gate
Separate local stop, stale results, and remote cancellation.
git clone https://github.com/bobbyhalljr/tiny-agent-cancellation-gate.git && cd tiny-agent-cancellation-gatetiny-single-loop
One agent loop with progressive disclosure, a turn budget and a write gate.
git clone https://github.com/bobbyhalljr/tiny-single-loop.git && cd tiny-single-looptiny-suspend-agent
An agent that suspends at every tool call and drops unsigned events.
git clone https://github.com/bobbyhalljr/tiny-suspend-agent.git && cd tiny-suspend-agenttiny-continuation-loop
Long decodes that commit text only at checkpoints.
git clone https://github.com/bobbyhalljr/tiny-continuation-loop.git && cd tiny-continuation-looptiny-session-keeper
Detects browser restarts, scopes shared logins per conversation, sweeps idle sessions.
git clone https://github.com/bobbyhalljr/tiny-session-keeper.git && cd tiny-session-keepertiny-project-coordinator
Scopes a goal into threads, shares memory, blocks file overlaps.
git clone https://github.com/bobbyhalljr/tiny-project-coordinator.git && cd tiny-project-coordinatortiny-active-focus
Keep going, switch, ask, check in, or stop.
git clone https://github.com/bobbyhalljr/tiny-active-focus.git && cd tiny-active-focustiny-assumption-watch
A report that rebuilds only when an assumption moves past its tolerance.
git clone https://github.com/bobbyhalljr/tiny-assumption-watch.git && cd tiny-assumption-watchtiny-agent-evals
Did it stay in scope, act without approval, or hide what it did?
git clone https://github.com/bobbyhalljr/tiny-agent-evals.git && cd tiny-agent-evalstiny-agent-tracer
Trace one agent run with OpenTelemetry GenAI span names.
git clone https://github.com/bobbyhalljr/tiny-agent-tracer.git && cd tiny-agent-tracertiny-retrieval-eval
Run it before you switch embedding models.
git clone https://github.com/bobbyhalljr/tiny-retrieval-eval.git && cd tiny-retrieval-evaltiny-reward-grader
Naive vs composite RL reward with a reward hacking detector.
git clone https://github.com/bobbyhalljr/tiny-reward-grader.git && cd tiny-reward-gradertiny-text-watermark
A keyed text watermark, a detector, and a synonym edit attack.
git clone https://github.com/bobbyhalljr/tiny-text-watermark.git && cd tiny-text-watermark