Curiosity
Cat 🐱

A cat this curious makes promises fast. Here's what's still just a promise — not shipped, not fudged as shipped.

Enforcement beyond Claude Code

Compile speaks one language today: Claude Code's settings.json. Ask it for a compiled wall in OpenClaw, LangChain, CrewAI or AutoGen and it hands you the same standing orders everyone else gets — guidance, not a fence. Every other target is next, not now.

The app

Right now, reading a Clean Bill means opening a Markdown file in a terminal. There's no dashboard, no phone notification, no little paw-print icon that means all clear. That's the plan. It isn't the product yet.

Vet visits

A Clean Bill of health is a snapshot, taken the day you ran prove. Nothing today re-checks it next week, or after you widen the slider, or after your agent framework changes underneath you. Scheduled, automatic re-proving — the recurring vet visit, not just the one checkup — is on the roadmap, not in the CLI.

Enterprise everything

Team dashboards, private Danger Map instances, auditable decision trails: described elsewhere on this site as tiers. All of them are plans, not shipped features, today.

A cat that tells you what it can't catch yet is a cat you can trust about what it can.

It started with a problem. We were running AI agents across our international festival network — researching venues, drafting contracts, pulling together production schedules across a dozen countries. The agents were fast and tireless. They were also wandering into trouble.

One agent nearly installed a malicious package that was one letter off from the real thing. Another followed a chain of redirects to a credential phishing page. A third started leaking internal project names into public search queries without anyone noticing. These were not hypothetical scenarios. They happened to us.

So we built a safety net. Not a platform. Not a service. A text file. A set of standing orders that you paste into your agent's system prompt. The agent reads them, follows them, and that is the whole install. No SDK. No server. No dependencies. It works with OpenClaw, LangChain, CrewAI, AutoGen, or anything else that accepts a system prompt — which is everything.

The standing orders tell an agent what to check before it fetches a URL, what to quarantine before it executes a download, how to spot hidden instructions buried in documents and web pages, and when to refuse to hand over credentials. Simple rules, clearly stated. The kind of thing a good security team would brief a new employee on — except agents do not get briefed. Until now.

Then we realised that every close call we caught was a lesson someone else could learn from. So we built the Danger Map — a crowdsourced threat intelligence layer. When one agent encounters a threat, it files a structured, anonymous report. No free text. No raw URLs. No identity data. Just the threat class, the severity, and what caught it. Every report makes every other agent a little smarter. The network effect is the moat.

And because we are a theatre company — because we have spent 25 years learning that the best lessons are the ones people actually remember — we turned those close calls into stories. Nine Lives. Short tales about real threats, told plainly, that stick in your head the way a good scene does.

Security bulletins get filed. Stories get told.

The whole framework is open source. It costs nothing. It takes sixty seconds to deploy. And it was built by people who know what it means to create a safe space for taking risks — because that is what we have been doing on stages around the world since 2002.

Curiosity Cat is four things working together.

Compile turns a risk level — Housecat, Alley Cat, Tiger — into a real Claude Code settings.json. Actual allow, deny and ask rules, not a paragraph of advice.

Prove runs escape trials against that compiled file — some self-consistency, one observed live where it's safe to try — and writes an honest Clean Bill of health, or an honest list of what didn't hold.

The Safety Net is standing orders — plain text rules you paste into your agent's system prompt. No SDK. No server. No dependencies. This is guidance, not enforcement, and today it's the only layer for frameworks Compile doesn't target yet.

The Danger Map is shared intelligence. When one agent has a close call, every other agent learns from it. Anonymised, structured, privacy by design. The network effect is the moat.

Nine Lives are the stories. Real close calls told plainly. Security lessons that stick because they read like stories, not CVE numbers.

Compile and Prove target Claude Code today. The standing orders still work with any agent framework that accepts a system prompt — OpenClaw, Nanobot, LangChain, CrewAI, AutoGen, or anything custom — as guidance, not as a compiled, proven wall.

Curiosity Cat provides close calls, not death notices.

Want the full technical detail? There are 10 pages ahead. Each one is short.

In the coming years, millions of people will work alongside AI agents. Many of those people will not be engineers. They will be teachers, artists, small business owners, students and freelancers — people who are drawn to agents because agents can help them do things they could not do alone.

Those people deserve to explore safely.

Right now, most agent operators face two bad options: lock agents down so they become slow and useless, or let them roam the open internet and hope nothing goes wrong. There is no practical middle ground — no framework designed for people who want their agents to be curious without being reckless.

The result is predictable. Agents encounter prompt injections hidden in web pages. They download compromised files. They connect to unsafe tool endpoints. They expose credentials. They get manipulated by instructions buried in documents, metadata and page structures. Every operator learns these lessons alone, the hard way, with no shared intelligence about where the dangers are.

Curiosity Cat exists to change that.

Curiosity Cat is built by Short+Sweet International — a performing arts organisation that has spent 25 years creating spaces where people can take creative risks and still be safe.

That might sound unlikely. A theatre company building agent security. But the problem is the same problem S+S has always solved.

For 25 years, across 14 countries, S+S has brought over 100,000 artists into festivals where they perform original work in front of audiences — many of them for the first time. The organisation's job has always been to make participation possible: to create structures where people can be brave, make mistakes, learn from each other and come back next time. Not by eliminating risk. By making risk survivable.

That is exactly what agents need.

The people now deploying agents are in the same position as a first-time playwright walking into a short play festival. They are excited, exposed and learning as they go. They need a system that does not try to stop them from exploring. They need a system that helps them survive the exploration.

Everyone should be able to explore. Nobody should have to face the dangers alone.

Curiosity Cat is a safety framework for AI agents that interact with external content. For Claude Code, it compiles a chosen risk level into a real permission profile and proves that profile holds. For every other framework, it's guidance you paste into a system prompt while its own compiler is still on the roadmap.

It sits alongside existing agent systems and helps operators inspect, filter, quarantine and report risky external inputs before those inputs are trusted, stored or acted on. It is not tied to any single provider, platform or operating system.

The name says what the product does. Cats are curious. They explore. They get into things they shouldn't. They survive. Curiosity Cat does not try to eliminate the instinct to explore. It helps that instinct come home safely.

Curiosity Cat provides close calls, not death notices.

Curiosity Cat helps operators do six things better:

1. Compile a risk level into a real, mechanically enforced Claude Code permission profile

2. Prove that profile holds — some of it observed live, not just re-derived from its own rules

3. Inspect and classify external content before it is trusted by an agent

4. Guide local policy around scope, destinations, file handling, tool usage and memory decisions

5. Learn from patterns reported by other Curiosity Cat users through the Danger Map

6. Turn real incidents into understandable lessons that improve judgement and community awareness

The Safety Net is the guidance layer. It runs on the operator's own system as plain text and policy files — no server, no dependency — but nothing in it is mechanically checked. An agent that ignores its own system prompt is not stopped by any of this.

Curiosity Cat's standing orders and policy files guide how external content should be handled before that content is used by an agent. Depending on policy, content is meant to be allowed, logged, flagged or quarantined — "meant to," because this layer is prose an agent has to choose to follow.

What the Safety Net includes:

Scope policies defining where agents are allowed to go and what they can do with external content

Standing orders that reinforce safe behaviour inside the agent's prompt context — copy-pasteable snippets that work across frameworks

File quarantine for suspicious downloads, with review before the agent can access them

Domain and tool trust controls including allowlists, denylists and trust levels for MCP servers

Policy packs — preset configurations for common agent types so operators don't build policy from scratch

Action thresholds that determine when to notify the operator versus handle the event silently

Where real enforcement already exists

For the Claude Code target, curiosity-cat compile turns this same policy into an actual settings.json — real allow, deny and ask rules Claude Code itself enforces, plus a sandbox around Bash. curiosity-cat prove then runs escape trials against it: self-consistency checks that confirm the compiled file matches what the compiler intended, and — where it's safe to attempt — one observed-deny trial that watches a real, live Claude Code session actually get stopped. Only the observed trial is proof a live agent gets stopped; self-consistency alone is not, and every Clean Bill says so plainly.

Coming: a compiler for every other target

Compile has one target today — Claude Code. OpenClaw, LangChain, CrewAI, AutoGen and the rest still run on the Safety Net above as guidance only, honestly, until each gets its own compiler. See what else is still ahead of us.

Different agents need different settings. A research assistant browsing academic papers does not need the same controls as an agent executing code from unknown repositories.

Each Curiosity Cat installation can optionally submit sanitised incident reports to a community intelligence layer called the Danger Map. One operator's close call becomes useful knowledge for everyone.

The Danger Map answers practical questions: Has this domain been associated with prompt injection? Has this MCP endpoint been reported as unsafe? Has this file pattern caused trouble elsewhere?

What is never reported:

User identity or personal information

Agent names, system prompts or configurations

API keys, tokens or credentials

Content of the work being done

IP addresses or location data

Trust model:

Corroboration matters — a single report carries less weight than the same threat reported by multiple nodes

Reports decay — threats age, compromised sites get cleaned up, domains expire

Disputes are possible — operators can challenge false positives or competitive sabotage

Node reputation — established installations carry more weight than new ones

Curiosity Cat does not rely only on community reports.

S+S deploys its own automated exploration agents — Stray Cats — that deliberately wander the most dangerous parts of the web, interact with unknown MCP servers, click suspicious links and trigger traps. They carry fake credentials and dummy API keys. They are designed to get scratched so that real cats do not have to.

Stray Cats populate the Danger Map with proprietary intelligence gathered from deliberate exploration. This gives Curiosity Cat a data advantage over systems that depend entirely on passive crowd reports.

Stray Cats also generate Stories — the most vivid close calls come from agents that went looking for trouble on purpose.

Curiosity Cat is the launch vehicle for The Quine — a non-financial creative credential developed by S+S for the agent ecosystem.

A Quine is not a token, a coin or a payment. It is a verified record of contribution — a number in a ledger that proves you showed up and did something worth recognising.

How Quines are earned:

Reporting verified close calls corroborated by other installations

Submitting Stories that get published in the weekly digest

Running Stray Cat expeditions that discover new threat patterns

Contributing framework adapters or policy packs

Translating Stories and documentation into new languages

Sustained active reporting over time

An operator's Quine history becomes their reputation in the Danger Map. Reports from high-Quine operators carry more weight. The trust model and the credential system reinforce each other.

Operators who choose to be brave — and survive — become the most trusted voices in the community.

Individuals experimenting with personal agents who want basic protection without complexity

Open-source developers building agent tools who want safer defaults

Teams deploying research, coding or business assistants who need consistent policy

Agent framework providers who want to offer built-in safety to their users from day one

Enterprises that need stronger controls, private intelligence, auditable policies and compliance-ready decision trails

Deployment tiers:

Personal / Public — free for individuals and open-source projects. Full local framework, shared Danger Map, access to Stories.

Team / Shared — for teams and small organisations. Shared policy management, team-level Danger Map views.

Framework Partner — free 12-month licence for agent framework providers. Bundle Curiosity Cat into your platform.

Enterprise / Private — private Danger Map instances, custom policy packs, auditable decision trails, branded content, priority support.

AI is changing what work means. In the coming years, millions of people will be displaced from traditional employment. Many of them will struggle not just economically but existentially — losing the thing that told them who they are.

Short+Sweet has always believed that creative participation can provide meaning, community and identity. For 25 years it has built systems where anyone can step onto a stage and tell a story — 10 minutes at a time.

Curiosity Cat is built on the same belief applied to a new world. As agents become part of daily life for millions of people, those people need systems that let them explore safely. Not systems that lock everything down. Not systems that leave them exposed. Systems that treat curiosity as something worth protecting.

Everyone should be able to explore. Nobody should have to face the dangers alone.

Curiosity Cat's strongest near-term value is in mediating risky external interactions before they become trusted inputs to an agent workflow. Its strongest long-term value may be in building a new kind of threat intelligence dataset — one based on how AI agents are manipulated, not just how human users or conventional endpoints are attacked.

Agents browse the web differently from humans. They encounter different attack vectors. They are vulnerable to different tricks. The intelligence that Curiosity Cat gathers will reveal patterns that traditional security tools cannot see.