Install Gubernaut

The controller sees intensity, valence, repetition and nothing else. The controller's zero-token boundary is architectural and not yet adversarially tested. No jailbreak success-rate figure exists, because none was measured.

Three commands. Two shapes.

Both carry the same controller, so a posture decision is identical either way. The ElizaOS plugin on npm is a client of Tiller, and it does nothing without the proxy running.

Gubernaut Tiller, the proxy

Tiller is a local proxy that speaks the OpenAI API, and the agent's calls go through it. On a verbatim loop the hard stop lands at turn 4: the turns before it are sent and billed, and the stopped call never leaves the machine.

pip install gubernaut-sdk

• PyPI

Tiller on GitHub (opens in a new tab)More about Tiller

Gubernaut Keel, the library

Keel is a library that runs inside the program. Same input, same decision, every run, so it can be tested and signed off, at the edge and on a server alike.

npm install @gubernaut/core

• npm
• crates.io

Keel on GitHub (opens in a new tab)More about Keel

Three places to get it

How do I install Gubernaut?

Gubernaut installs from the standard registry for each language: pip for the Gubernaut Tiller proxy, npm or cargo for the Gubernaut Keel controller. Each is one command, and each is Apache-2.0 and runs entirely on the machine it is installed on.

• Gubernaut TillerPythonpip install gubernaut-sdk
• Gubernaut KeelRust / WASMcargo add gubernaut-core
• A Gubernaut Tiller clientNode / on-chainnpm install @gubernaut/plugin-gcc

Which models were tested, and what did each save?

Gubernaut's verbatim-loop battery covers seven measured configurations across four model families, and the reduction in upstream spend ranged 79.8% to 95.9%, with the largest on GPT-5.6 Sol and the smallest on Claude Haiku 4.5. Both arms make the same number of attempts, so the spend delta is the whole measurement.

Injection resistance is claimed for the controller only, the token-free meta level. The arbiter reads raw text by necessity, and its posture compliance is a measured property rather than an architectural property. The controller's zero-token boundary is architectural and not yet adversarially tested. No jailbreak success-rate figure exists, because none was measured. Measured through the proxy, Gubernaut Tiller; with Gubernaut Keel the calling code carries out the stop.

What does Gubernaut cost?

Nothing. Gubernaut is released under Apache-2.0 and runs entirely on the infrastructure it is installed on. There is no paid tier, no usage metering and no account to create.

How do I verify these numbers myself?

Run them. The Gubernaut record reproduces in four levels, and the first three need no API key and cost nothing. 30 seconds gets the controller's own test suite, 2 minutes gets the hard stop at turn 4 end to end against a mock upstream, and the last level is the spend table, which costs real money because it is a real bill.

git clone https://github.com/thegubernaut/gubernaut.git
cd gubernaut/packages/python
pip install -e ".[dev]"
python -m pytest tests -q

cd packages/rust
cargo test

# 1. mock upstream
python ../../examples/mock_upstream.py

# 2. the governed proxy, pointed at the mock
python -m gcc_proxy --upstream http://127.0.0.1:18081

# 3. the loop
python ../../examples/openai_sdk_demo.py

cd packages/python
export OPENAI_API_KEY=...        # your key, your bill
python -m gcc_proxy --upstream https://api.openai.com

You can re-run this and get the same numbers. Not similar numbers, the same ones.

Can I put a hard gate in front of my existing LLM stack?

Yes, if the stack speaks the OpenAI chat-completions API. Gubernaut was installed from its published artifacts into 5/5 agent frameworks, and each adopted it in one configuration line, hard-stopped a runaway loop, and failed closed when the proxy was killed. The controller is model-agnostic by construction: it reads numbers, not output format, so a family it has never seen behaves the same way.

• OpenAI SDKopenai.base_url
• LangChainChatOpenAI(base_url=…)
• LlamaIndexOpenAI(api_base=…)
• Microsoft AutoGenconfig_list base_url
• ElizaOSOPENAI_BASE_URL

What does Gubernaut not do?

Gubernaut governs loop dynamics and the spend they cause, at the meta level, per turn. A deployment that needs any of the following needs something else alongside it.

• not a content filter. It does not read, classify or block what the model says.

• not a rate limiter. It severs on the controller's meta-state, not on a request count or a time window.

• not a jailbreak defense. It reduces what an attack costs; it does not decide whether one succeeds.

• not an evaluation harness. It governs a live request path and does not score models.

• not a hosted service. It runs on your machine, in your request path, under Apache-2.0.

Longer answers live in the guides, shorter ones on the questions hub, every term is defined once on the glossary, and what shipped in each version is on the releases page.