Getting Started • Overview

RTQ Overview

RTQ is a security-focused capability-security runtime for Node.js, TypeScript, Model Context Protocol (MCP) servers, and mobile approval hosts. Security-critical packages declare zero third-party npm runtime dependencies. Every operation requires an explicitly registered capability; authorizations are short-lived, single-use, cryptographically-signed tickets.

Why RTQ Was Created

While developing Aartiq, a disproportionate amount of engineering time was spent repeatedly implementing OS-level sandboxing, capability scoping, fine-grained permission gating, and challenge-response authorization from scratch.

RTQ was created to solve this problem for developers everywhere — packaging a security-focused capability security runtime into a clean suite of reusable packages. Developed and validated through automated security testing, RTQ enables developers to integrate capability security, OS-enforced sandboxing, Model Context Protocol (MCP) policy enforcement, and mobile QR challenge-response approvals into their applications without having to build security infrastructure from scratch.

System Capabilities & Verification Evidence

Implemented

• Capability registry with schema validation
• Authoritative risk evaluation engine
• Default-deny declarative policy engine
• Process-local single-use ticket store
• macOS Seatbelt, Linux bwrap, Windows AppContainer sandbox adapters
• Redacted structured audit logger

Verified in CI

• 12 Automated security invariants (INV-01 .. INV-12)
• Platform sandbox execution tests
• Cross-language protocol vectors (Node vs Dart)
• 430+ unit, contract & security test suite

Scope & Evidence Limits

• Ticket store redemption state is process-local
• Empirical CI testing, not formal mathematical proof
• Mobile keypairs use platform storage (Keystore/Keychain)
• Handler logic remains part of host application TCB
• No independent third-party audit performed

Release v1.0.0 & Downloads

GitHub Release v1.0.0

Tag provenance, assets & source code

Android Mobile App (.apk)

Flutter Ed25519 approval host (62 MB)

Core Security Pipeline

Command → Capability (registered) → Risk (authoritative) → Policy (default-deny)
→ Clarification → Approval (challenge-response) → Ticket (signed, single-use)
→ Execution (OS-sandboxed) → Audit (redacted)