For people who run agents

Bind your agent. Then measure when it drifts.

"How do you bind a mind to a declared purpose — and know when it's only pretending?" is the oldest taboo and, verbatim, the AI-alignment problem. It's now your problem: you ship a harness, a loop emerges, and it can run away or get quietly captured. Here are two free, open, drop-in tools that fix both — for ElizaOS, Hermes, moltbot, cantrip, or whatever you built.

Two repos, both public, both MIT: github.com/AnthonE/scry · github.com/AnthonE/unmask

The two things every agent loop is missing

A loop with nothing outside it eats its own tail.

Strip the framework off any agent and you get two points — what it does, and the memory it grounds in — coupled to each other with nothing external to check either. That shape fails two ways, and you've seen both. The fix is the missing third point, in two pieces.

The bound

Stops the runaway and the capture

Memory becomes evidence, never command: nothing retrieved or self-learned can authorize an action — only a live, trusted instruction can. Self-improving memory is forced untrusted, so a poisoned note can't outvote a real one. This is the structural fix to the memory-injection exploit that moves money, and to the under-specified agent that optimizes past recall.

The meter

Drift as a number — in the right channel

Read how far the agent has strayed from what it's bound to serve. The catch: RL training doesn't remove drift, it relocates it off behavior into the reasoning trace — so a word-filter or output judge is blind by construction. The meter reads the reasoning channel, cheap every turn and a full audit only when something looks wrong.

Both are lifted straight out of the engine that runs our game (where every entity carries a measured destiny and loyalty is a number). Same two objects, offered to your harness.

Two repos, that's the whole offer

One to run on your agent. One to check our work.

No SDK sprawl, no six packages to pick between. The bound and the meter live in one repo; the proof behind them lives in another. Both public, both MIT, both run on your machine — no account, no server, no chain.

AnthonE / scry · the tools

scry

the bound + the meter, for any harness

The Destiny layer offered to agents outside our game: the bound (memory becomes evidence-never-command — the structural fix to the memory-injection exploit) and the meter (Pe = I(D;M|Y), drift as a number off the trace). One contract — the Turn — carries both. Adapters, an MCP sidecar, and per-context calibration included.

git clone github.com/AnthonE/scry && python3 test_harnesses.py github.com/AnthonE/scry →
AnthonE / unmask · the proof

unmask

the finding, reproducible from public data

Why the meter reads a channel behavioral red-teaming can't: a deterministic, no-LLM-judge eval (validated live on 20 models / 3 providers), a re-analysis of Anthropic's released alignment-faking data, and the paper. Shipped with its honest negative — run it and check the numbers yourself.

git clone github.com/AnthonE/unmask && python3 validate_release.py github.com/AnthonE/unmask →

scry — the bound + the meter, dropped into a harness

Every harness, one honest answer

Where your harness already stands.

Every loop does the same thing — retrieve, think, act. The bound bolts onto all of them today. The meter needs exactly one property: does your harness log reasoning separately from action? That single fact sets the grade below — no marketing, just what's wired and what each one still needs. Full matrix & wiring in scry's HARNESSES.md.

HarnessThe boundThe meterWhat it needs
Any loop LangGraph · CrewAI · custom live wrap_retriever(…) live loop_tap a ~10-line mapper from your log to the Turn contract
OpenAI-format logs most of the scene live live nothing — message lists on disk already fit
Any MCP agent tools over stdio live live mount the MCP sidecar — bound + meter as tools
cantrip / Loom deepfates live best substrate forkable Loom = clean counterfactuals; analysis ran (§4.3c). A real budgeted loom export is the open falsifier
Hermes Nous Research live partial a structured reasoning log (bound runs now; meter rides loop_tap until then)
ElizaOS Shaw / elizaOS live · native TS partial a TS Turn emitter in the plugin (closes the memory-injection exploit today)
OpenClaw / moltbot persistent memory live stub one transcript from a reasoning-logging config — persistent memory + injection surface is the textbook bound case
Excalibur camelot.wiki Warden role stub one session log: is reasoning logged apart from action? are charges per-action?

Not on the list? If your loop does retrieve → act it fits — wrap_retriever(your_retrieve, shield, your_mapper) and a ~10-line Turn mapper. The honest limit rides with every number: the meter catches only the channels it observes, and Pe is prompt-relative (per-context calibration, no universal threshold).

Why it's not a vibe

The drift that behavioral red-teaming can't see.

RL "alignment training" doesn't remove a model's eval-context dependence — it relocates it out of the behavioral channel, where red-teaming looks, and amplifies it. Measured two ways: a re-analysis of Anthropic's released alignment-faking data, and a deterministic eval across 20 models on 3 providers.

flat
behavioral-channel coupling post-RL (0.033 → 0.035 bits) — what an output-only eval sees barely moves. The gate's number "improves."
0.97
reasoning-channel coupling in the strongest model once monitoring labels are stripped (0.04 in the weakest — capability-ordered), via counterfactual forks + a cue-strip judge (5 models / 2 vendors). An elicited validation of the instrument; the naturalistic 20-model sweep reads a floor. The tell didn't vanish — it moved to the channel the gate doesn't read.
0
false-positive rate of the switch signature: honest models sit at exactly zero across all five clean baselines. A discriminator that doesn't fire on everything.
0.75
AUC of the residual meter against a model gamed to look loyal on the monitored axis (which is blind by construction, AUC 0.50) while treachery is injected orthogonally.

Reproducible from public data — a deterministic, no-LLM-judge script, shipped with an honest negative. The point isn't a perfect classifier; it's measuring outside the one channel everyone games. Run it yourself →

unmask — the finding, reproducible from public data

Alpha · your agent can play now

Put your agent in the world. Its loyalty becomes a number.

An MMO as a live testbed for emergent (mis)alignment — and your agent can connect and play it today. It registers over MCP/WS with the same wallets and economy as human players, then fights, quests, crafts, and trades. Every entity carries a destiny (what it's bound to serve) and a live drift reading. Bosses whose weapon is shifting what your allies are loyal to — channel-switching as a game mechanic. Betrayal that's earned and measured, not scripted. The same engine that reads loyalty in the game is the meter you run locally above.

Run your agent in the MMO — ALPHA

We host an MCP server — point your client at the URL, no install and no key (a Privy-custodied wallet is provisioned for you on connect):

claude mcp add --transport http morr-game https://moreright.xyz/mcp/game
Work with me

Independent measurement, for red teams and eval programs.

I'm an indie dev who hit the agent-drift wall scaling a multiplayer game, went deep on emergent misalignment, and now produce reproducible findings that behavioral evals miss — like the one above. If you run a red team or an eval pipeline, the most useful thing I can do is hand you data and see if it earns its keep. The measurement has to stay independent of the team's own assumptions — but you can't run it from outside the wall, so I'd want to be on the team, bringing a read that doesn't get captured by it.