TACIT: Tracked Agent Capabilities In Types

What is TACIT?

TACIT is a safety harness for AI agents that uses Scala 3's capture checking type system to statically track capabilities and enforce safety. It provides an MCP interface for use by MCP-compatible agents like Claude Code, OpenCode, and GitHub Copilot.

How to use TACIT?

Download the prebuilt release JARs (or build from source with sbt), then configure your agent to run the server with java -jar TACIT.jar --library-jar /path/to/TACIT-library.jar. Optionally disable the agent's built-in tools to route all operations through TACIT. For stateful tasks, use session tools (create_repl_session, execute_in_session, etc.).

Key features of TACIT

• Scala 3 compiler with capture checking in safe mode
• Local REPL for stateless or stateful code execution
• Capability-safe library for file, process, and network access
• Classified[T] type enforces pure-only access to sensitive data
• Dual LLM design: trusted local model processes classified content
• Tools: execute_scala, session management, show_interface

Use cases of TACIT

• Sandbox agent code execution with compile-time capability enforcement
• Granularly control file system, process, and network access per session
• Prevent exfiltration of classified data (API keys, secrets) to cloud LLMs
• Run multi-step agent tasks with persistent state across interactions

FAQ from TACIT

What are the runtime requirements?

JDK 17+ is required. No local Scala installation needed—the server bundles the Scala 3 compiler and REPL.

How do I configure classified paths?

Use the --classified-paths CLI flag or the corresponding field in the JSON config file to specify comma-separated paths whose content becomes Classified[String].

How does TACIT prevent data leakage?

The Classified[T] type enforces that only pure functions can transform classified data; any attempt to send it over the network or write it to an unclassified file is rejected at compile time.

Can I run multiple stateful sessions?

Yes. Use create_repl_session to get a session ID, then execute_in_session to run code in that session. Sessions persist until deleted with delete_repl_session.

How do I disable my agent's built-in tools?

Examples are provided for Claude Code (--disallowedTools), OpenCode (permission "deny"), and GitHub Copilot (VS Code settings). This forces all operations through TACIT's sandboxed REPL.