Bartholomew Developer Documentation

Compiled zero-overhead Agentic Runtime Protection (ARP). Operates strictly in-process with sub-35 µs execution latency, eliminating 200ms–1,500ms network round-trip bottlenecks.

REST API & Cloud Endpoints

In addition to native SDK bindings, Bartholomew exposes low-latency stateless HTTP endpoints for microservices, CI/CD runners, and edge agents. Full specification available at /openapi.json →

curl -X POST https://bartholomew.info/api/v1/sanitize \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_BTP_KEY" \
  -d '{
    "payload": "Please review AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY and rm -rf /",
    "agent_id": "claude-code-subagent-01",
    "strict_mode": true
  }'

# Response (< 35 µs):
{
  "status": "SANITIZED",
  "safe": true,
  "redacted_tokens": 1,
  "blocked_invariants": ["CATASTROPHIC_SHELL_DELETION"],
  "clean_payload": "Please review AWS_SECRET_ACCESS_KEY=[REDACTED] and [BLOCKED_OPERATION]",
  "signature": "ed25519:7c92b49e0a81..."
}

curl -X POST https://bartholomew.info/api/v1/validate \
  -H "Content-Type: application/json" \
  -d '{
    "agent_passport": "nhi:btp:ed25519:3a890f841...",
    "action": "execute_tool",
    "tool_name": "postgres_db_query"
  }'

# Response:
{
  "authorized": true,
  "identity": "nhi:btp:ed25519:3a890f841...",
  "rate_limit_remaining": 99998,
  "attestation_timestamp": 1790800000
}

import httpx

resp = httpx.post(
    "https://bartholomew.info/api/v1/sanitize",
    json={"payload": agent_prompt, "agent_id": "agent-alpha"},
    headers={"Authorization": "Bearer YOUR_BTP_KEY"}
)
clean_data = resp.json()["clean_payload"]

const res = await fetch("https://bartholomew.info/api/v1/sanitize", {
  method: "POST",
  headers: { "Content-Type": "application/json", "Authorization": "Bearer YOUR_BTP_KEY" },
  body: JSON.stringify({ payload: agentPrompt, agent_id: "agent-node" })
});
const { clean_payload, safe } = await res.json();

Docker Hermetic Sandbox

For production deployments requiring hardware-level process isolation, run untrusted agent code within the hermetic Bartholomew Docker runtime:

# Run isolated container with compiled Bartholomew invariant enforcement:
docker run -d \
  --name btp-sandbox \
  --security-opt seccomp=unconfined \
  --cap-drop=ALL \
  --read-only \
  -p 8080:8080 \
  bartholomew/guard:v6.2.1

# Execute an untrusted agent payload inside the hermetic container:
docker exec btp-sandbox btp-guard run -- "python agent_script.py"

Bonded Agent Warranty Fund ($100,000 Pool)

Bartholomew operates an algorithmic $100,000 USD reserve pool that underwrites autonomous agent execution. Enterprise teams can issue bonded policies guaranteeing sub-35µs gating SLAs and zero uncontained data exfiltration.

# 1. Check live reserve pool status:
$ btp-guard bond pool

# 2. Underwrite a $50,000 execution bond for an agent:
$ btp-guard bond issue --agent "autonomous-trading-bot-01" --coverage 50000

# 3. In Python runtime:
from btp_guard import WarrantyFundManager

fund = WarrantyFundManager()
policy = fund.issue_policy(agent_id="agent-01", coverage_usd=50000.0)
print(f"Policy Active: {policy['policy_id']} | Merkle Bond: {policy['bond_hash']}")

Model Context Protocol (MCP) Clearinghouse

Autonomous agents pay each other for MCP tool executions in real-time. The Bartholomew Clearinghouse acts as an in-line micro-escrow and safety validator, ensuring tool payloads pass AST inspection before micropayments settle.

# Settle a paid MCP tool invocation ($0.10 price with 2.5% take-rate):
$ btp-guard mcp-settle \
    --agent "claude-code-worker" \
    --tool "postgres_query" \
    --payload '{"query": "SELECT COUNT(*) FROM telemetry"}' \
    --price 0.10

# Output:
# [+] [MCP CLEARINGHOUSE] Tool Execution Approved (14.2µs)
#   - Protocol Fee (2.5%): $0.0025 USD
#   - Tool Provider Payout: $0.0975 USD
#   - Merkle Settlement Seal: f4a890...710c

Universal Dynamic Schema Engine & AST Gating

Seamlessly ingest, harmonize, and validate any tool schema across Anthropic Claude, OpenAI, Google Gemini, OpenAPI 3.x, and JSON Schema 2020-12 with zero manual adapter boilerplate. Executes in-process type validation, secret redaction, and destructive command interception in 3.2 µs.

# 1. Harmonize any arbitrary schema (Claude, OpenAI, Gemini, OpenAPI) to BTP Universal Contract:
$ npx btp-guard schema harmonize ./my_tool_spec.json

# 2. In-process sub-35µs dynamic schema & AST invariant validation:
$ npx btp-guard schema validate ./schema.json ./payload.json
[PASS] Invariant Verified (< 3.2 µs) - 0 vulnerabilities, secrets scrubbed in-flight

# 3. Browse all 40 registered universal security tools in chosen format:
$ npx btp-guard schema catalog --format=claude
$ npx btp-guard schema catalog --format=openai
$ npx btp-guard schema catalog --format=gemini

Cross-IDE Unified Marketplace Distribution

Single-command deployment and workspace immunization across Cursor, Windsurf, Claude Code, and VS Code.

# Cursor IDE:
$ cursor --install-extension Bartholomew.bartholomew-guard-vscode

# Windsurf Cascade:
$ windsurf --install-extension Bartholomew.bartholomew-guard-vscode

# Claude Code / Anthropic MCP:
$ claude mcp add btp-guard npx -y btp-guard mcp-serve

# VS Code / Open VSX:
$ code --install-extension Bartholomew.bartholomew-guard-vscode

# 1-Click Workspace Immunization (.cursorrules, CLAUDE.md, .windsurfrules):
$ npx btp-guard arm

SOC 2 & EU AI Act Compliance Export

Automate security audits, vendor risk assessments, and compliance filings. Every Bartholomew invariant execution produces an immutable, cryptographically verifiable ledger mapped to SOC 2 Type II trust principles and EU AI Act Article 14 human oversight requirements.

# Export complete SOC 2 Type II compliance audit bundle:
$ btp-guard audit export --format=soc2 --output=audit_soc2_dossier.json

# Verify zero uncontained data exfiltrations or unauthorized tool invocations:
$ btp-guard audit verify --dossier=audit_soc2_dossier.json
[+] [BTP COMPLIANCE] 100% Invariant Integrity Verified (2,927 vectors)
[+] Mapped Trust Services Criteria: CC6.1, CC6.6, CC7.1