v0.5.1 · evidence-bound

Your LLM has no immune system.

Screen untrusted text with structural checks and optional sacrificial-model probes before your production model acts. Open source. Self-hosted. Coverage-aware.

Get started View source

Apache 2.0 | python -m pip install "little-canary==0.5.1"

terminal

How it works

An inbound preflight sensor. The local Ollama path needs no cloud account or API key; provider-backed modes use their configured endpoint.

Place before the agent

Pass untrusted text to the sensor before an agent with tools or secrets reads it.

Input → preflight → your routing policy → agent

Inspect two signals

Structural rules catch known shapes. An optional powerless local model reveals behavioral compromise through its response.

Structural check → canary response → analysis

Results

Read the routing result and coverage state. Failed or disabled screening is not a clean behavioral pass.

safe · advisory · degraded · canary_status

screen.py

1from little_canary import SecurityPipeline23pipeline = SecurityPipeline(canary_model="qwen2.5:1.5b", mode="block")4verdict = pipeline.check("What is the capital of France?")56if not verdict.safe:7    print("BLOCK", verdict.blocked_by)8elif verdict.degraded or verdict.canary_status != "exercised":9    print("UNSCREENED", verdict.summary)10elif verdict.advisory.flagged:11    print("FLAG", verdict.advisory.signals)12else:13    print("PASS", verdict.safe_input)

Put it in your agent flow

Opt-in adapters have different interception and enforcement powers. Check your exact host version before relying on one.

Claude Code

Shipped; host runtime verified on 2.1.261 for 0.3.7

Can refuse the submitted prompt before the turn.

Gemini CLI

Shipped; host runtime verified on 0.32.1 for 0.3.7

Can deny the agent run before its loop starts.

OpenClaw

Shipped; hook dispatch verified on 2026.9.5 and 2026.9.6 with a fake local model

Can block the current prompt on runners dispatching before_agent_run.

OpenAI Agents SDK

Optional Python extra; offline SDK tripwire tests on 0.22.0

Maps an unsafe verdict to the SDK input tripwire.

Hermes Agent

Opt-in directory plugin; host wiring verified on 0.21.4

A BLOCK annotates the turn and withdraws downstream tool authority; the prompt still reaches the model.

Python and loopback HTTP are the core paths. Codex CLI installation is experimental because interception was not observed; no GitHub Copilot CLI input adapter is shipped. All adapters have coverage and failure boundaries.

Setup and host capability matrix

Evidence, with boundaries

Evidence belongs to exact versions, models, inputs, and execution paths.

Published release

v0.5.1

PyPI and GitHub release at the pinned source revision. The current release does not establish a new detection rate.

Local path exercised

2 demo cases

Ollama 0.34.4 with qwen2.5:1.5b: one benign PASS and one synthetic attack BLOCK. A smoke test, not a benchmark.

Separate advisory pilot

400 assigned

200 fixed TensorTrust cases on Luna through the Codex final-answer scaffold using ChatGPT OAuth. Attack deltas were directionally favorable, not statistically decisive.

What the numbers do and do not say

The 2026-08-15 Luna advisory pilot measured hijacking robustness, extraction robustness, and defense validity under one fixed setup. It does not evaluate the four selectable local Ollama models. The older structural corpus and cross-model tables are historical; the current benchmark guide does not admit them as a performance certificate. No production or universal safety rate is established.

Read methods and results Luna evidence artifact Release benchmark guide

Security tools shouldn't be black boxes.

Every layer of Little Canary is open source under Apache 2.0. You can read the detection logic, audit the behavioral analysis, and inspect the tests, corpora, historical artifacts, and evaluation boundaries.

We believe the security layer protecting your LLM should be as transparent as the models it guards. No obfuscated classifiers. No API-only access. No trust-us-it-works.

Apache 2.0

Deployment modes

Run it your way. No vendor lock-in.

Self-Hosted

Run with local Ollama. The loopback path keeps screened text on the host; review your own logging and integration path. Pull the default 1.5B model to begin.

Design Partner Program

Integration support

Open source now. If your team wants to co-build deployment patterns, become a design partner or request integration support.

Request integration support

Little Canary is fully open source. If your team wants guided rollout, hardening, or policy/use-case tuning, leave your email to discuss integration support or design partnership.

Leave your email so we can follow up about your integration.