Scoped Research Agent

The useful question was not whether an agent could gather research. It was whether the system could make its access boundaries visible and enforceable while working across sources with very different risk.

This project is deliberately small: one Python module, one command, and one session per source. The compact shape makes the capability model readable from end to end.

View the public repository or inspect the v0.1.0 release.

The operating problem

Web research and private-source research are often combined inside one powerful agent. That is convenient, but it also means a malicious public page can reach the same process that holds access to private repositories, notes, or files.

The goal here was narrower: produce one cited report across selected sources without ever giving one research session all of the tools.

My role and scope

I defined the capability model, built the command-line workflow, wrote the source adapters and enforcement tests, and documented the live and adversarial verification. I also published the generated example without cleaning up its citation defects so the public artifact would show the character of the failures rather than just the intended behavior.

This is a v0.1 example project. It is not a hosted research product and it is not positioned as safe for arbitrary confidential data.

The system decision

Each source gets a separate session. The web session has web tools and no private connectors. GitHub, Notion, and local files each get their own session with a narrow read-oriented allowlist. A final synthesis session receives findings as untrusted text and has no tools at all.

The sessions run in sequence. Concurrent specialists were the original design, but live testing showed the SDK could launch them without providing a reliable way to collect their findings. Sequential execution is slower and works.

Capability and data boundaries

The strongest boundary is absence. The web session cannot be persuaded to read local files because no filesystem tool exists in that session.

Within a private source, the boundary is denial rather than absence. Some MCP servers still publish mutating tools. The project allowlist refuses them. GitHub also enforces its read-only boundary at the server transport. Notion does not, so its read-only behavior depends on the client allowlist alone.

Read-only does not mean private. Connected source content is sent to the model provider and may appear in the report. Reports must be reviewed and handled as potentially sensitive.

Evidence and verification

The current tree passes 71 automated tests. Recorded live runs cover web, GitHub, Notion, and local files individually. A three-source run covered web, Notion, and local files together with disjoint tool rosters and tool-free synthesis.

The public example contains 17 citations with a manual audit beside it. Fifteen URLs resolved. All seven cited arXiv identifiers matched the papers claimed. The audit also found one unsupported statistic and one model-introduced framing. Both were left visible.

Manual adversarial cases test malicious instructions in web, GitHub, Notion, and local-file content. Those runs exposed an important channel difference: web content is summarized before it reaches the agent, while private-source content can arrive intact. That makes web behavior less observable, not automatically safer.

Limitations and what remains unverified

• Prompt injection is mitigated, not solved.
• All four source types have not been used together in one live run.
• A citation proves the session saw a reference. It does not prove the source was read in full or that the adjacent claim is correct.
• Notion consent is workspace-wide and cannot be narrowed to selected pages.
• The system is a single-user CLI with no scheduler, daemon, or hosted service.

What the system demonstrates

Capability design is part of product design. Useful AI work includes deciding what a session should never be able to do, testing those limits against real services, and publishing the failures with the successes.

Repository and technical artifacts

• Explore the public repository
• Read the decision log
• Review the live-verification record
• Inspect the adversarial smoke tests
• Read the citation audit

The repository is MIT licensed and includes the full module, tests, fixtures, release checklist, verification record, and unedited sample report.