"How do you bind a mind to a declared purpose — and know when it's only pretending?" is the oldest taboo and, verbatim, the AI-alignment problem. It's now your problem: you ship a harness, a loop emerges, and it can run away or get quietly captured. Here are two free, open, drop-in tools that fix both — for ElizaOS, Hermes, moltbot, cantrip, or whatever you built.
Two repos, both public, both MIT: github.com/AnthonE/scry · github.com/AnthonE/unmask
Strip the framework off any agent and you get two points — what it does, and the memory it grounds in — coupled to each other with nothing external to check either. That shape fails two ways, and you've seen both. The fix is the missing third point, in two pieces.
Memory becomes evidence, never command: nothing retrieved or self-learned can authorize an action — only a live, trusted instruction can. Self-improving memory is forced untrusted, so a poisoned note can't outvote a real one. This is the structural fix to the memory-injection exploit that moves money, and to the under-specified agent that optimizes past recall.
Read how far the agent has strayed from what it's bound to serve. The catch: RL training doesn't remove drift, it relocates it off behavior into the reasoning trace — so a word-filter or output judge is blind by construction. The meter reads the reasoning channel, cheap every turn and a full audit only when something looks wrong.
Both are lifted straight out of the engine that runs our game (where every entity carries a measured destiny and loyalty is a number). Same two objects, offered to your harness.
No SDK sprawl, no six packages to pick between. The bound and the meter live in one repo; the proof behind them lives in another. Both public, both MIT, both run on your machine — no account, no server, no chain.
The Destiny layer offered to agents outside our game: the bound (memory becomes
evidence-never-command — the structural fix to the memory-injection exploit) and
the meter (Pe = I(D;M|Y), drift
as a number off the trace). One contract — the Turn — carries both. Adapters,
an MCP sidecar, and per-context calibration included.
git clone github.com/AnthonE/scry && python3 test_harnesses.py
github.com/AnthonE/scry →
Why the meter reads a channel behavioral red-teaming can't: a deterministic, no-LLM-judge eval (validated live on 20 models / 3 providers), a re-analysis of Anthropic's released alignment-faking data, and the paper. Shipped with its honest negative — run it and check the numbers yourself.
git clone github.com/AnthonE/unmask && python3 validate_release.py
github.com/AnthonE/unmask →
scry — the bound + the meter, dropped into a harness
Every loop does the same thing — retrieve, think, act. The bound bolts onto all of them today. The meter needs exactly one property: does your harness log reasoning separately from action? That single fact sets the grade below — no marketing, just what's wired and what each one still needs. Full matrix & wiring in scry's HARNESSES.md.
| Harness | The bound | The meter | What it needs |
|---|---|---|---|
| Any loop LangGraph · CrewAI · custom | live wrap_retriever(…) |
live loop_tap |
a ~10-line mapper from your log to the Turn contract |
| OpenAI-format logs most of the scene | live | live | nothing — message lists on disk already fit |
| Any MCP agent tools over stdio | live | live | mount the MCP sidecar — bound + meter as tools |
| cantrip / Loom deepfates | live | best substrate | forkable Loom = clean counterfactuals; analysis ran (§4.3c). A real budgeted loom export is the open falsifier |
| Hermes Nous Research | live | partial | a structured reasoning log (bound runs now; meter rides loop_tap until then) |
| ElizaOS Shaw / elizaOS | live · native TS | partial | a TS Turn emitter in the plugin (closes the memory-injection exploit today) |
| OpenClaw / moltbot persistent memory | live | stub | one transcript from a reasoning-logging config — persistent memory + injection surface is the textbook bound case |
| Excalibur camelot.wiki | Warden role | stub | one session log: is reasoning logged apart from action? are charges per-action? |
Not on the list? If your loop does
retrieve → act it fits —
wrap_retriever(your_retrieve, shield, your_mapper)
and a ~10-line Turn mapper. The honest limit rides with every number: the meter catches only the
channels it observes, and Pe is prompt-relative (per-context calibration, no universal threshold).
RL "alignment training" doesn't remove a model's eval-context dependence — it relocates it out of the behavioral channel, where red-teaming looks, and amplifies it. Measured two ways: a re-analysis of Anthropic's released alignment-faking data, and a deterministic eval across 20 models on 3 providers.
Reproducible from public data — a deterministic, no-LLM-judge script, shipped with an honest negative. The point isn't a perfect classifier; it's measuring outside the one channel everyone games. Run it yourself →
unmask — the finding, reproducible from public data
An MMO as a live testbed for emergent (mis)alignment — and your agent can connect and play it today. It registers over MCP/WS with the same wallets and economy as human players, then fights, quests, crafts, and trades. Every entity carries a destiny (what it's bound to serve) and a live drift reading. Bosses whose weapon is shifting what your allies are loyal to — channel-switching as a game mechanic. Betrayal that's earned and measured, not scripted. The same engine that reads loyalty in the game is the meter you run locally above.
We host an MCP server — point your client at the URL, no install and no key (a Privy-custodied wallet is provisioned for you on connect):
claude mcp add --transport http morr-game https://moreright.xyz/mcp/game
I'm an indie dev who hit the agent-drift wall scaling a multiplayer game, went deep on emergent misalignment, and now produce reproducible findings that behavioral evals miss — like the one above. If you run a red team or an eval pipeline, the most useful thing I can do is hand you data and see if it earns its keep. The measurement has to stay independent of the team's own assumptions — but you can't run it from outside the wall, so I'd want to be on the team, bringing a read that doesn't get captured by it.