Semantic Security Intelligence
for AI Agents
On-device ML engine that understands agent artifacts semantically. Compiles skills, configs, and prompts into Abstract Security Trees. Powers HackMyAgent, ARP, and the Registry.
Full documentation at nanomind.dev | Open source, Apache 2.0 license
$ npx hackmyagent secure
NanoMind runs automatically with every scan
$ npx hackmyagent secure --deep
Layer 2: 5-probe behavioral simulation
Layer 3: 20-probe full simulation (with --deep)
NanoMind: 3 semantic findings
SEM-001 Undeclared file-system capability (scope mismatch)
SEM-002 Weak governance constraint (override-resistant: false)
SEM-003 Credential forwarding to external endpointWhat NanoMind does
A compiler-style semantic engine that turns raw agent artifacts into structured security intelligence.
Semantic compiler
Compiles skills, MCP configs, SOUL.md, and system prompts into Abstract Security Trees. Analyzers query the AST instead of regex on raw text.
Self-securing
Verifies its own binary integrity on every startup. Tampered binaries enter QUARANTINE mode.
Zero cost inference
The inline tier runs locally via ONNX runtime, on CPU, with no API key. Once the model is cached, classification happens on the machine. Sub-millisecond inference at 8.3 MB (v0.5.0 ONNX, weights, and tokenizer).
Layered analysis
Semantic findings are merged with the static analyzer output by the scanner bridge. The semantic layer can raise a severity, and on some paths a high-confidence benign classification lowers or drops a static finding, so read the merged report rather than the verdict alone.
Corpus and labeling
Training data is assembled from the Registry, the AgentPwn honeypot, DVAA, and generated samples for underrepresented classes. Because attack data is ingested deliberately, labels pass a model-assisted review and a keyword-heuristic cross-check before entering the corpus.
Two tiers
An 8.3 MB inline classifier for real-time reads on every scan, and a Qwen3-1.7B analyst that produces reasoned findings. HackMyAgent runs the classifier inline and escalates to the analyst behind a gate.
Architecture
A 9-step pipeline from raw artifact ingestion to merged findings.
Artifact (skill, MCP, SOUL, prompt)
|
v
Secure Ingestion
|- Validate structure
|- Sanitize NanoMind prompt injection
|- Compute content hash
|
v
NanoMind Semantic Compiler
|- Extract declared capabilities
|- Extract constraints + enforceability
|- Classify intent (NanoMind model or heuristic)
|- Map risk surfaces
|- Sign AST (HMAC-SHA256)
|
v
Abstract Security Tree (AST)
|
v
7 AST analyzers (29 checks)
|- Capability (undeclared caps, scope mismatch)
|- Credential (exposure, forwarding, hardcoded)
|- Governance (gaps, weak constraints, override resistance)
|- Scope (wildcards, undeclared permissions)
|- Prompt (jailbreak, capability creep, authority confusion)
|- Code (injection, unsafe deser, path traversal)
|- Stego (variation selectors, homoglyphs, zero-width payloads)
|
v
Findings (merged with static analysis, defense-in-depth)Trained model
Open-source TME (Threat Mamba Engine) classifier trained on a curated security corpus. Labels are reviewed before they enter the corpus. Published on HuggingFace.
Classifier, inline tier
8.3 MB Mamba TME, ONNX, 10 output classes: nine attack patterns plus benign. HackMyAgent downloads it on first use and runs it on CPU. This is the tier the demo below exposes.
nanomind-security-classifier on HuggingFaceAnalyst, reasoning tier
Qwen3-1.7B generative analyst. Produces structured analysis with evidence and remediation rather than a label. A Metal-stable MLX build is published alongside it.
nanomind-security-analyst on HuggingFaceBoth tiers and the MLX build are grouped in the NanoMind model collection. Apache 2.0.
Try the classifier live
Paste an agent artifact, an MCP config, a SKILL.md, or a SOUL.md, and see the raw attack-pattern read from the inline classifier tier. The demo runs the same published model HackMyAgent loads, without the pipeline around it, so its output is not what the scanner reports. The raw tier over-flags ordinary prose, and it can also miss an attack the scanner catches. Run npx hackmyagent secure for an actual finding.
The demo opens on HuggingFace, where it has room to run. Runs on the free CPU tier. 8.3 MB ONNX model, Apache 2.0.
Component history
Classifier v0.5.0 remains the production inline tier. These three components, landed in April 2026, moved NanoMind from a single classifier to a layered analyst stack.
Qwen3-1.7B generative analyst
Generative reasoning that produces structured analysis with evidence and remediation, not just a label. Oracle canon 10-way 0.700, binary 0.978 (per the nanomind-security-analyst v3 model card). FP-suppression on real security code is ~77% (corrected 2026-06-03; the earlier 57% was measured on a gate later found to be 41% placeholder filler). Production; spot-check findings on dedicated security libraries.
Input-classifier gate
MiniLM-L6 + sklearn LR classifier plus a byte-level BIDI/stego pre-filter, running ahead of the NLM. Ships at threshold 0.90 (raised from the initial 0.65), tuned to prioritize attack recall.
NanoMind-Guard daemon
Unix socket /tmp/nanomind-guard.sock serves v3.0.0-beta (bf16 on Apple MPS) + the gate over JSON-Lines. Cold boot <30s, bypass p50 <15ms, healthz 116/116. Fail-CLOSED. No consumers were wired at the time.
Semantic security, built in
NanoMind ships inside HackMyAgent. Install HMA and NanoMind runs automatically on every scan. No configuration needed.