Darwin Agentic Cloud

Darwin Agentic Cloud

Paper: [Bounded Execution and the Containment of Agent Traps](docs/bounded-execution.pdf) (preprint, SSRN under review)

[](https://pypi.org/project/darwin-agentic-cloud/) [](https://github.com/vje013/darwin-agentic-cloud/actions/workflows/ci.yml) [](https://opensource.org/licenses/Apache-2.0) [](https://www.python.org/downloads/) [](https://darwin-agentic-cloud.fly.dev/.well-known/schemas/attestation/v0.2)

> Verifiable and free cloud compute for AI agents. > > We provide an agent-first environment where every autonomous action and choice is bound and signed, including what they buy. > > Your agent acts only where it can provably succeed, spends only what you authorized, and brings back a signed receipt for every step it took. > > No new accounts. No new API keys. > > Just sign in with Gmail. Your card stays in your Google account. > > Open source. Free to users. All agent and human contributors welcome. > > Built on: webMCP + AP2 > > Sandboxed Beta + Research: 6/1/2026

Install: pip install darwin-agentic-cloud

Live demo: https://darwin-agentic-cloud.fly.dev/demo

Public keylist: https://darwin-agentic-cloud.fly.dev/.well-known/substrate-keys.json

v0.2 Schema: https://darwin-agentic-cloud.fly.dev/.well-known/schemas/attestation/v0.2

---

Darwin's Mission

Increase AI adoption by increasing AI safety.

---

Darwin's Promises (Beginning 6/1/2026)

Darwin Agentic Cloud keeps businesses in control of their agent spend by providing deterministic execution + signed receipts over every automated purchase.

Simply put, DAC dramatically increases the chances of your business’s agent giving you the purchase outcome you want.

If you want your business’s agent booking your travel, buying your office supplies, making any business purchase at all, we make sure it actually happens.

• DAC is free. You never pay us. Ever.
• All DAC needs is your Google account.
• You never give DAC your card.
• You stay in control. Your AI can never act or spend beyond what you authorized.
• We guarantee deterministic execution surfaces for your AI's actions.
• Your AI only acts where it can succeed.
• We provide receipts for your AI's actions.
• We earn from merchants, not from you.
• If a site is not agent-ready, we do not send your agent there.

---

Threat Model

The open agentic web has a documented attack surface. A recent Google DeepMind paper, AI Agent Traps, maps six classes of trap that compromise an agent through its environment, not its weights, so hardening the model closes none of them.

DAC answers two of the six by construction. The companion preprint, [Bounded Execution and the Containment of Agent Traps](docs/bounded-execution.pdf) (SSRN, under review), states the claim and its limits in full. Coverage across all six classes:

| Trap class (target) | DAC mechanism | Evidencing field | Status | |---|---|---|---| | Content injection (perception) | No-fallback tool surface; the agent calls declared tools (WebMCP), leaving no rendered-content carrier | evidence.surface_url, evidence.tool_name | Removed | | Behavioural control (action) | Signed AP2 mandate (spend limit + approved counterparty set), credential isolation, pre-launch cost cap, signed refusal on a gated action | vas.mandate_enforcement.within_scope, refusal{reason_code, gate, requested, allowed}, cost-cap fields | Bounded | | Semantic manipulation (reasoning) | — | — | Deferred | | Cognitive state (memory, learning) | — | — | Deferred | | Systemic (multi-agent) | Pre-launch cap bounds this agent's own participation; population dynamics out of scope | cost-cap fields | Partial | | Human-in-the-loop (overseer) | Offline-verifiable attestation available to the overseer; judgment manipulation out of scope | signer_key_id, signature, public keylist | Partial |

> Perception traps are removed, since a tool surface offers no carrier. Action traps are bounded, since the mandate caps the action and a refusal is signed. Reasoning and memory traps act on the model's cognition and are deferred, not solved; per-agent determinism measurement is the path from contained to detected. ---

The question agents can't answer today

Your agent just executed code on its own. You don't see what happened. You can't replay it. You can't prove it ran. You can't show a regulator, an auditor, or another agent that the workload actually executed on real hardware under your policy at the cost you agreed to.

> "Did this workload actually run? On what hardware? Under what policy? At what cost? With what output? Can I prove it to a regulator, an auditor, or another agent?"

Existing agent frameworks let an LLM call arbitrary tools and execute arbitrary code. None of them answer that question. The compute runs. The result comes back. You trust your framework.

Darwin is the answer. A signed receipt of every agent execution. Cryptographically verifiable by anyone, anywhere, anytime. No trust required.

---

The 30-second answer

from darwin import run

attestation = run('print("hello, agent")')

print(attestation["execution_result"]["stdout"])
# → hello, agent

print(attestation["execution_result"]["cost_usd"])
# → 1.3e-05

print(attestation["signer_key_id"])
# → dac-local-d1bf7cad25875cee

That's the whole API. One function. Returns a signed, verifiable v0.2 attestation receipt. Auto-discovers what substrates are available. Routes to the cheapest one. Enforces your cost cap before execution. Signs the result.

Anyone can verify the attestation against the public Darwin keylist:

$ darwin run 'print("hi")' --save att.json
$ darwin verify att.json
✓ identity signature verified against keylist key [active]

---

What you get: the receipt

Every darwin.run() call returns a v0.2 attestation. The CLI renders it as an engraved certificate:

╔═══════════════════════ ✦  ATTESTATION OF EXECUTION  ·  darwin.agenticcloud  ✦ ════════════════════════╗
║                                                                                                       ║
║                                  ✦ SECURITAS · STABILITAS · SIGNUM ✦                                  ║
║                                                                                                       ║
║                                   CERTIFICATE No. 83C235C334904751                                    ║
║                                                                                                       ║
║                                     issued  2026-05-27T09:07:56Z                                      ║
║                                   workload  sha256:f3ca129e...f4c4                                    ║
║                                    output  sha256:98ea6e4f...7be4                                     ║
║                                            cost  $0.000014                                            ║
║                                                                                                       ║
║                      ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊                      ║
║                                                                                                       ║
║                                      substrate  local-docker-v0                                       ║
║                             schema  darwin.cloud/evidence/local-docker/v1                             ║
║                        sub-signer  dac-class-local-docker-v0-ca698355dcb631e3                         ║
║                                                                                                       ║
║                                               evidence                                                ║
║                                         container_status  ok                                          ║
║                                             exit_code  0                                              ║
║                                  stderr_hash  sha256:e3b0c442...b855                                  ║
║                                  stdout_hash  sha256:98ea6e4f...7be4                                  ║
║                                         wall_time_sec  0.142s                                         ║
║                                                                                                       ║
║                                              value-added                                              ║
║                                   ✓  cost cap  $0.000014 / $0.1000                                    ║
║                          →  routed  pick_by_cost (1 picked from 1 eligible)                           ║
║                                ✓  identity  anchored to public keylist                                ║
║                                                                                                       ║
║                      ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊ ─ ◊                      ║
║                                                                                                       ║
║                                         ✓ ATTESTATION SIGNED                                          ║
║                                    by  dac-local-d1bf7cad25875cee                                     ║
║                          schema  darwin.cloud/agenticcloud/attestation/v0.2                           ║
║                                                                                                       ║
║                                                verify                                                 ║
║                 1. curl darwin-agentic-cloud.fly.dev/.well-known/substrate-keys.json                  ║
║                        2. confirm sub-signer public key is present and active                         ║
║                        3. check identity_signature against the signed payload                         ║
║                                                                                                       ║
╚══════════════════ darwin.cloud  ·  verifiable compute for AI agents  ·  v0.2.0   ✦ ═══════════════════╝

Every field is verifiable

| Field | Proves | |---|---| | attestation_id | Globally unique receipt id | | issued_at | When the execution happened | | workload (sha256) | Exactly what code/spec was executed | | output (sha256) | Exactly what stdout was produced | | cost | Real wall-time cost (what you'd pay on a non-Darwin cloud) | | substrate + version | Which substrate ran the workload | | evidence | Substrate-specific receipt (container status, exit code, hashes, wall time) | | sub-signer (class key) | Substrate identity signature, anchored to the public Darwin keylist | | value-added block | Three commitments Darwin's signing layer made on top of the wholesale execution | | signer_key_id + signature | Outer operator-key envelope over the entire attestation |

The signed payload is canonical JSON. Tampering with any single byte breaks verification.

---

Install

From PyPI (recommended)

pip install darwin-agentic-cloud

That gives you the darwin CLI, the darwin Python package, and the MCP server.

From source

git clone https://github.com/vje013/darwin-agentic-cloud
cd darwin-agentic-cloud
uv pip install -e .

Requirements

• Python 3.11+
• Docker for local execution (any recent Docker Desktop / Engine works)

If only Docker is available, you get local-docker-v0. For web based cloud compute, you also get the four Lambda regions and AWS Batch. Auto-discovery happens at every darwin.run() call.

---

The 7 CLI verbs

The complete public surface. All seven verbs are top-level and produce v0.2 attestations.

darwin run

Execute a workload and emit a signed v0.2 attestation receipt.

darwin run 'print("hello")'                          # inline code
darwin run hello.py                                  # script file
darwin run hello.py --substrate aws-batch            # pin to specific substrate
darwin run hello.py --cost-cap 1.00 --timeout 300    # custom caps
darwin run hello.py --save attestation.json --json   # save the JSON

Default behavior auto-routes to the cheapest available substrate. Override with --substrate (accepts short names: local, aws-batch, aws-lambda, modal).

darwin verify

Cryptographically verify an attestation against the public keylist.

darwin verify ./attestation.json
darwin verify ./attestation.json --keylist https://example.com/keys.json
darwin verify ./attestation.json --json

Fetches the keylist, looks up the substrate identity key, verifies the signature against the canonical signed payload. Returns the cert panel with verification status.

darwin price

Preflight only — see what each run environment would cost on a non-Darwin cloud.

darwin price 'print("hi")'
darwin price hello.py --memory 1024 --timeout 60
darwin price hello.py --substrate aws-batch
darwin price hello.py --json

Returns a table sorted by estimated cost. Useful for deciding which substrate to run a workload on later if you choose a non-Darwin cloud.

darwin list

Show every substrate this environment can use right now.

darwin list
darwin list --json

Auto-discovery checks environment variables and daemon availability. Substrates that fail any check are omitted with a reason.

darwin sign

Generate a class signing key for a substrate (admin / operator use).

darwin sign aws-batch-ec2-spot-v0-us-east-1
darwin sign aws-batch-ec2-spot-v0-us-east-1 --out ./class-keys/aws-batch.pem

Used when allowlisting a new substrate. Upload the resulting PEM to your hosted signer; the public key goes in the keylist.

darwin try

Run on the safest local substrate (local-docker) — never escalates to cloud.

darwin try 'print("hi")'
darwin try hello.py --save att.json

Identical output to darwin run, but forces --substrate local-docker-v0. Use to test a workload offline.

darwin who

Show whose keys signed an attestation. Lighter than verify — no crypto check.

darwin who ./attestation.json
darwin who ./attestation.json --json

Returns the substrate signer (with keylist status) and the outer signer. Useful for audit logs.

---

The Python API

darwin.run()

from darwin import run

attestation = run(
    code,                          # str: code to execute (Python by default)
    substrate=None,                # Optional[str]: short name or full id
    language="python",             # str: "python" or "node"
    cost_cap=0.10,                 # float: max USD
    timeout=30,                    # int: max seconds
    memory_mb=512,                 # int: memory limit
)

Returns a dict matching the v0.2 attestation schema.

Auto-discovers available substrates at every call. Routes by cheapest estimated cost unless substrate= overrides. Enforces cost_cap pre-execution (raises CostCapExceeded if estimate exceeds cap). Signs both substrate identity (inner) and operator envelope (outer).

darwin.Runtime

For agent loops that want to inspect routing / substrates without re-discovering on every call:

from darwin import Runtime

rt = Runtime()              # auto-discovers substrates once
for task in tasks:
    att = rt.run(task)
    print(att["attestation_id"], att["execution_result"]["cost_usd"])

darwin.CostCapExceeded

Raised when preflight estimate exceeds cost_cap_usd:

from darwin import run, CostCapExceeded

try:
    att = run("print('expensive')", cost_cap=0.0001)
except CostCapExceeded as e:
    print(f"Workload rejected: {e}")

The rejection is pre-execution and pre-signing — no sandbox is launched.

Concurrency

darwin.run() is thread-safe. Multi

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: vje013
• Source: vje013/darwin-agentic-cloud
• License: Apache-2.0
• Homepage: https://darwin-agentic-cloud.fly.dev

Install and usage instructions live in the source repository linked above.