Skip to main content

Defense API Specification

Version: v1.3.0 | Status: Active | Last Updated: July 2026

Public Classes​

SymbolPurpose
ActiveDefensePrompt-exploit detection, context poisoning, honeytokens, and metrics
RabbitHoleContainment session tracker with decoy responses
DefenseRequest-processing orchestrator
RateLimiterSliding-window rate limiter
ThreatDetectorDetection-rule evaluator
DetectionRuleRule dataclass with name, category, severity, check, description, and response
ThreatEventEvent dataclass emitted by request processing

Enums​

  • ThreatLevel: NONE, LOW, MEDIUM, HIGH, CRITICAL
  • Severity: INFO, LOW, MEDIUM, HIGH, CRITICAL
  • ResponseAction: LOG, THROTTLE, BLOCK, ALERT, QUARANTINE, RABBITHOLE, POISON

Primary Methods​

MethodReturns
ActiveDefense.detect_exploit(text)dict with detected, patterns, and threat_level
ActiveDefense.poison_context(attacker_id, intensity)dict with attacker id, generated content, intensity, and timestamp
ActiveDefense.create_honeytoken(label)Honeytoken string
ActiveDefense.check_honeytoken(text)Triggered token list
ActiveDefense.get_threat_report()Metrics dictionary
Defense.process_request(source, request)(allowed, threats) tuple
Defense.add_detection_rule(rule)None
Defense.block_source(source) / unblock_source(source)None

Factory​

create_defense(config=None) returns a Defense instance.

Validation​

  • Source tests: uv run pytest tests/unit/defense/ -q
  • API import check: python -c "from codomyrmex.defense import Defense, ActiveDefense"