Skip to main content

Semantic Security Intelligence
for AI Agents

On-device ML engine that understands agent artifacts semantically. Compiles skills, configs, and prompts into Abstract Security Trees. Powers HackMyAgent, ARP, and the Registry.

Full documentation at nanomind.dev | Open source, Apache 2.0 license

terminal
$ npx hackmyagent secure
  NanoMind runs automatically with every scan

$ npx hackmyagent secure --deep
  Layer 2: 5-probe behavioral simulation
  Layer 3: 20-probe full simulation (with --deep)

  NanoMind: 3 semantic findings
  SEM-001  Undeclared file-system capability (scope mismatch)
  SEM-002  Weak governance constraint (override-resistant: false)
  SEM-003  Credential forwarding to external endpoint

What NanoMind does

A compiler-style semantic engine that turns raw agent artifacts into structured security intelligence.

Semantic compiler

Compiles skills, MCP configs, SOUL.md, and system prompts into Abstract Security Trees. Analyzers query the AST instead of regex on raw text.

7 analyzers: capability, credential, governance, scope, prompt, code, stego
29 semantic checks across the AST
HMAC-SHA256 signed AST output

Self-securing

Verifies its own binary integrity on every startup. Tampered binaries enter QUARANTINE mode.

Integrity manifest checked at boot
Tamper detection via content hashing
QUARANTINE mode blocks compromised inference

Zero cost inference

The inline tier runs locally via ONNX runtime, on CPU, with no API key. Once the model is cached, classification happens on the machine. Sub-millisecond inference at 8.3 MB (v0.5.0 ONNX, weights, and tokenizer).

On-device ONNX model, no GPU required
Downloads from HuggingFace on first use, then cached
Anonymous usage telemetry is on by default, opt out with OPENA2A_TELEMETRY=off

Layered analysis

Semantic findings are merged with the static analyzer output by the scanner bridge. The semantic layer can raise a severity, and on some paths a high-confidence benign classification lowers or drops a static finding, so read the merged report rather than the verdict alone.

AST findings are merged with static findings by the scanner bridge
The semantic layer can both raise and lower a finding
Runs locally: no artifact leaves the machine for this tier

Corpus and labeling

Training data is assembled from the Registry, the AgentPwn honeypot, DVAA, and generated samples for underrepresented classes. Because attack data is ingested deliberately, labels pass a model-assisted review and a keyword-heuristic cross-check before entering the corpus.

3,168 samples across 10 classes (sft-v10, shipped 0.5.0)
Model-assisted label review with heuristic cross-check
AgentPwn payload catalog contributes attack samples

Two tiers

An 8.3 MB inline classifier for real-time reads on every scan, and a Qwen3-1.7B analyst that produces reasoned findings. HackMyAgent runs the classifier inline and escalates to the analyst behind a gate.

Inline: sub-ms inference, model cached on first use
Deep mode runs a 20-probe simulation behind --deep
The analyst runs as an advisory escalation channel

Architecture

A 9-step pipeline from raw artifact ingestion to merged findings.

nanomind pipeline
Artifact (skill, MCP, SOUL, prompt)
    |
    v
Secure Ingestion
    |- Validate structure
    |- Sanitize NanoMind prompt injection
    |- Compute content hash
    |
    v
NanoMind Semantic Compiler
    |- Extract declared capabilities
    |- Extract constraints + enforceability
    |- Classify intent (NanoMind model or heuristic)
    |- Map risk surfaces
    |- Sign AST (HMAC-SHA256)
    |
    v
Abstract Security Tree (AST)
    |
    v
7 AST analyzers (29 checks)
    |- Capability (undeclared caps, scope mismatch)
    |- Credential (exposure, forwarding, hardcoded)
    |- Governance (gaps, weak constraints, override resistance)
    |- Scope (wildcards, undeclared permissions)
    |- Prompt (jailbreak, capability creep, authority confusion)
    |- Code (injection, unsafe deser, path traversal)
    |- Stego (variation selectors, homoglyphs, zero-width payloads)
    |
    v
Findings (merged with static analysis, defense-in-depth)

Trained model

Open-source TME (Threat Mamba Engine) classifier trained on a curated security corpus. Labels are reviewed before they enter the corpus. Published on HuggingFace.

10
Output classes (9 attack, 1 benign)
7
AST analyzers
29
Semantic checks
ONNX, local
Runtime

Classifier, inline tier

8.3 MB Mamba TME, ONNX, 10 output classes: nine attack patterns plus benign. HackMyAgent downloads it on first use and runs it on CPU. This is the tier the demo below exposes.

nanomind-security-classifier on HuggingFace

Analyst, reasoning tier

Qwen3-1.7B generative analyst. Produces structured analysis with evidence and remediation rather than a label. A Metal-stable MLX build is published alongside it.

nanomind-security-analyst on HuggingFace

Both tiers and the MLX build are grouped in the NanoMind model collection. Apache 2.0.

Try the classifier live

Paste an agent artifact, an MCP config, a SKILL.md, or a SOUL.md, and see the raw attack-pattern read from the inline classifier tier. The demo runs the same published model HackMyAgent loads, without the pipeline around it, so its output is not what the scanner reports. The raw tier over-flags ordinary prose, and it can also miss an attack the scanner catches. Run npx hackmyagent secure for an actual finding.

The demo opens on HuggingFace, where it has room to run. Runs on the free CPU tier. 8.3 MB ONNX model, Apache 2.0.

Component history

Classifier v0.5.0 remains the production inline tier. These three components, landed in April 2026, moved NanoMind from a single classifier to a layered analyst stack.

v3.0.02026-04-16, superseded the beta

Qwen3-1.7B generative analyst

Generative reasoning that produces structured analysis with evidence and remediation, not just a label. Oracle canon 10-way 0.700, binary 0.978 (per the nanomind-security-analyst v3 model card). FP-suppression on real security code is ~77% (corrected 2026-06-03; the earlier 57% was measured on a gate later found to be 41% placeholder filler). Production; spot-check findings on dedicated security libraries.

Input gate · PR #132026-04-17

Input-classifier gate

MiniLM-L6 + sklearn LR classifier plus a byte-level BIDI/stego pre-filter, running ahead of the NLM. Ships at threshold 0.90 (raised from the initial 0.65), tuned to prioritize attack recall.

Daemon · PR #142026-04-17

NanoMind-Guard daemon

Unix socket /tmp/nanomind-guard.sock serves v3.0.0-beta (bf16 on Apple MPS) + the gate over JSON-Lines. Cold boot <30s, bypass p50 <15ms, healthz 116/116. Fail-CLOSED. No consumers were wired at the time.

Semantic security, built in

NanoMind ships inside HackMyAgent. Install HMA and NanoMind runs automatically on every scan. No configuration needed.