This is the largest release Authensor has shipped. v1.5.0-alpha adds five distinct layers of protection that work together: authorization protocol enforcement, behavioral anomaly detection, content safety scanning, shadow policy evaluation, and time-of-use attack prevention. Here is what changed and why.
The MCP Gateway now implements the SEP authorization protocol. Every tool call goes through a three-step message flow: authorization/propose sends the intent, authorization/decide returns the policy verdict, and authorization/receipt captures the immutable record. The gateway evaluates every call before forwarding it to the downstream tool server. If you are running an MCP client that does not support authorization messages, the gateway falls back to inline evaluation transparently. No changes needed on your side. This matters because it makes Authensor a drop-in layer between any MCP client and any MCP tool server, not a replacement for either.
Sentinel watches per-agent behavioral patterns and flags when something drifts. It builds baselines using EWMA (exponentially weighted moving averages) for trend tracking and CUSUM (cumulative sum control charts) for detecting sustained shifts. It monitors deny rates, latency spikes, and action volume changes per agent. It also tracks chain depth and fan-out across multi-agent delegations, so if agent A calls agent B calls agent C and the depth or breadth exceeds your threshold, you get an alert. Zero runtime dependencies. Runs in-process alongside the control plane.
Aegis now carries 15+ prompt injection detection rules, 22 memory poisoning rules informed by the MINJA attack research, PII detection, credential scanning, exfiltration pattern matching, and multimodal safety checks. All of this runs at sub-millisecond latency with zero dependencies. No API calls, no external services, no network round trips. The scanner runs synchronously in the evaluation pipeline, so it does not add meaningful latency to the authorization decision.
You can now run a candidate policy in shadow mode alongside your production policy. Both policies evaluate every intent. The production policy enforces. The shadow policy logs its decisions without affecting outcomes. When the shadow policy produces the same results as production over enough volume, you promote it with confidence. This is how you validate policy changes without risking a misconfigured rule blocking legitimate agent actions in production.
A subtle but important addition. When an agent receives an ALLOW decision and later claims the receipt to execute the action, the control plane re-evaluates the intent against the current policy at claim time. If the policy changed between the original decision and the claim, the updated rules apply. This closes the time-of-check/time-of-use gap where an agent could stockpile approvals, wait for a policy change, and execute stale permits.
API keys can now be bound to specific agent identities. In strict mode, a key issued to agent-finance-prod cannot be used by any other principal. This prevents key sharing and lateral movement between agents, which is one of the OWASP Agentic Top 10 risks (ASI05 - Insufficient Agent Authentication).
Official adapters now exist for LangChain, OpenAI Agents SDK, Vercel AI SDK, Claude Agent SDK, and CrewAI. Each adapter wraps the Authensor SDK so that policy evaluation happens automatically at the framework's tool-call boundary. No manual instrumentation required.
The test suite grew from roughly 400 tests to 924+ across 16 packages. Every package has its own test suite. The engine, Aegis, and Sentinel all maintain zero-dependency constraints, and those constraints are themselves tested.
Authensor now covers all 10 risks in the OWASP Agentic Top 10 (2026 draft), ASI01 through ASI10. We also mapped controls to EU AI Act Articles 9, 12, 13, and 14. The high-risk system deadline is August 2, 2026. If you are deploying agents in the EU, the compliance clock is ticking.
Run npx create-authensor to scaffold a project with policies, receipts, and monitoring preconfigured. Read the docs at authensor.com/docs. If you want to look at the code first, the repo is public -- star it, fork it, open issues. Feedback goes directly to me.