I'm Building MVAR: It's a deterministic execution firewall for LLM agents. The core idea: prompt injection becomes dangerous only when model output can trigger privileged execution.. Instead of detecting malicious prompts, MVAR enforces policy at the sink level.

Invariant: UNTRUSTED input + CRITICAL sink → BLOCK

Just hit PyPI this week. https://github.com/mvar-security/mvar