command-scope-contract

[](https://github.com/madeinplutofabio/command-scope-contract/actions/workflows/ci.yml) [](https://www.python.org/downloads/) [](LICENSE)

CSC is a lightweight protocol for bounded shell and CLI execution by AI agents.

CSC is complementary to MCP, not a replacement for it.

It exists to remove ambient authority from agentic execution.

Instead of giving an agent raw shell access, CSC requires the agent to submit a structured command contract that declares:

• what it wants to run
• why it wants to run it
• where it wants to run it
• what it needs to read
• what it may write
• whether it needs network access
• whether it needs secrets
• what kind of effect it may cause
• how long it may run

A trusted policy layer evaluates the contract. If allowed, a constrained executor runs it and emits a verifiable receipt.

Shell is useful because it is universal, composable, and token-efficient.

Shell is dangerous because it often carries too much implicit power.

CSC keeps the flexibility of shell while making scope, policy, and execution evidence explicit.

agent -> command contract -> policy gate -> constrained executor -> execution receipt

Draft / v0.1 bootstrap

Not production-ready. The current runner is a minimal reference implementation intended to validate the protocol shape.

• Keep shell composability.
• Remove raw arbitrary shell by default.
• Make intent and scope explicit before execution.
• Let trusted policy decide.
• Emit receipts for audit and provenance.
• Stay small enough to implement and adopt quickly.

CSC does not attempt to replace:

• container isolation
• IAM
• workflow engines
• sem