v0 core
Policy checks, hash-chained audit, the evidence pack and the synthetic demo.
shipped
Building in public
What has shipped in Inhold, and what is next?
Inhold v0, part of its hardening, OIDC and IAM-role sign-in, and MCP over HTTP are on main. Next are the AWS install and the public repo on 9 Nov.
Inhold is being built. No customers yet. Repo goes public 9 Nov 2026.
Shipped
Dates come from the repo's commit history. Older entries are dated 30 Oct 2026; IAM-role sign-in, MCP over HTTP and the install checker are dated 31 Oct 2026. Source links become public on 9 Nov 2026.
What is still missing is on the known gaps list.
Local PHI tagger
Pattern detection at write time, with caller labels added to detected labels.
shipped
MCP server
The agent can use the context tools over stdio.
shipped
30 red-team cases
RT01 to RT30 try to cross purpose and identity boundaries, in a seeded world with a leak oracle. None is excused: any leak fails the build.
shipped
Atomic audit under concurrency
Data changes and audit writes stay in one transaction, with chain writes serialized.
shipped
Pre-filtered search
Policy filters candidates before ranking, so refused items are never scored or returned.
shipped
Purpose bound to the MCP session
The session chooses a registered purpose at startup. Tool calls cannot change it.
shipped
Chain heads outside the database
Anchors outside the database are written when the store is created, every 100 rows and at each export, and are signed when an anchor key is configured. Local runs use write-once files on the same host; keep each pack to check the next one. An S3 Object Lock store, signed with a KMS HMAC key, is built in code and inhold anchor writes the heads there. It has not been run against a real AWS account.
shipped
OIDC sign-in for people
The gateway verifies tokens against pinned keys. On REST and MCP over HTTP, static tokens need a flag and are refused in AWS mode. The stdio MCP server still uses a static token with no flag, so it is laptop-only.
shipped
IAM-role sign-in for agents
Agents sign in with a presigned sts:GetCallerIdentity request, checked against regional AWS STS. OIDC is tested with generated signing keys and IAM sign-in with a stand-in for STS, not yet against a real identity provider or AWS account. Static tokens are laptop-only. On REST and MCP over HTTP they need a flag and are refused in AWS mode; stdio MCP still uses a static token with no flag.
shipped
MCP over HTTP on the gateway
The gateway serves the context tools over HTTP, authenticates each request and binds a registered purpose outside the tool arguments. Gateway tests cover writes, search, refused callers and purpose checks. The mTLS fallback is not built.
shipped
Install checker: inhold doctor
inhold doctor runs ten checks, D01 to D10, that an install is private and wired as designed, including network checks. It reads AWS APIs when you run it and is not part of the running service. Its tests use stubbed AWS answers.
shipped
Personal mode
One developer keeps their own Claude Code and Codex sessions on their own disk. Secrets are labelled SECRET and the coding agent cannot read them back through Inhold. A shell running as the same user can still read the files.
shipped
Subject on MCP writes
The MCP write and search tools take a subject, so an MCP agent gets the same PHI floor as a REST caller.
shipped
Failed sign-ins collapse
Repeated refused credentials write one audit row per reason per minute, with a count, so a flood of bad tokens cannot bury the log.
shipped
Next
Before the first pilot
AWS install
An install kit for the customer's existing VPC, customer-owned keys and private access. The install is in build.
Public repo, 9 Nov 2026
The repo goes public on 9 Nov 2026.