Resolve and inline JSON Schema / OpenAPI $refs — internal, cross-file, and remote — with session caching and a default-deny SSRF guard.

Default-deny network guard for Node.js test environments — blocks non-local TCP at the socket level.

Rampart — client-side PII redaction for AI assistants: deterministic recognizers + a 14.7 MB ONNX classifier (transformers.js), default-deny policy, and reversible placeholders. Runs entirely in the browser.

A lightweight, default-deny reverse edge for safely connecting private compute to public domains.

Policy enforcement for AI tool calls. Default-deny control for any MCP server.

Realtime messaging and project discussions on odla-db: project channels, post threads, bottom thread cards, scoped live updates, DMs, and AI participants over one default-deny graph.

Official TypeScript SDK for Alter Vault — privileged access for AI agents: vaulted credentials, default-deny policy, approval policies, and an audit trail for every call made through Alter

API-key authentication for NestJS — opaque hashed-at-rest keys, scopes, expiry, instant revocation, and a default-deny guard for machine & third-party callers.

zeroness Egress Worker — default-deny outbound proxy that enforces Broker decisions and injects brokered identity.

Server-Sent Events delivery to frontends — clients subscribe to all or individual events, each brick's event catalog decides who may receive what (default deny), and fan-out works across instances. Push is additive: apps never wait on it.

Default-deny CLI/terminal agent Pack — composes the shipped command-risk guard with allowlist EXECUTE, credential ESCALATE, maintenance DEFER, and a fail-closed default-deny sink.

Install script firewall for npm - default-deny lifecycle scripts with explicit, reviewable allowlists

Portable default-deny policy, grants, risk gates, and revocation for Pactmark

LAN/internet reverse-proxy gateway for the DeepSeek Harness web GUI: binds 0.0.0.0 and forwards to the loopback dsh web server. Default-deny: every source (loopback, LAN, internet) must sign in with an HMAC session cookie unless lanPasswordless is explici

Governed tool-call / sandboxed-exec primitive for Agentic-Dev: default-deny allowlist + Zod-strict argument schemas + execFile arg-arrays only (no shell) + structured argument provenance.

Default-deny Qi capability leases, credentials, delegation, and redaction

OpenAI Whisper wrapper with cost cap, rate limit, default-deny authz, queue, and audit log. Production-ready STT for Telegram bots.

Inbound message security gateway for bots — 5-layer default-deny (caller-validator, identity-resolver, rate-limit, audit, forward) for Telegram/WhatsApp/WeChat and other OTT platforms.

Headless browser automation for Ever Works - navigate, extract, screenshot and act on web pages via Playwright, behind a default-deny navigation allowlist that is re-checked on every redirect hop

Library for Ed25519-signed MCP tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Layer-2 mitigation for marketplace-poisoning, CVE-2025-69256, CVE-2025-61591.