Runtime security &
governance for
autonomous agents.
A lightweight local daemon that observes and governs every prompt, tool argument, secret, and loop across OpenCode, Claude Code, Codex CLI, and MCP clients. With 5-tier deterministic-to-neural inspection, Threat-RAG + ColBERT MaxSim, and GraphRAG 3-hop attack lineage.
Zero-trust governance
for the agentic era.
5-Tier Sequential Firewall Pipeline
Every inbound prompt and tool argument runs sequentially through 21 regex rules, structural and homoglyph heuristics, in-place secret redaction (AWS, GitHub, OpenAI), Threat-RAG + ColBERT MaxSim reranker, and local Llama Guard 3.
GraphRAG Attack Lineage
Detects 3-hop credential exfiltration paths across multi-turn sessions (AML.T0048) before data hits external sockets.
Circuit Breaker & Loop Guard
Enforces hard token, cost, and error ceilings. Intercepts infinite A-B tool cycles and sliding-window entropy collapse with automated SIGTERM termination.
MCP Governance Hub
3 built MCP servers (firewall, breaker, lineage) + 3 external connectors with strict least-privilege role boundaries over stdio, SSE, and JSON-RPC 2.0.
Defense in depth.
Local by design.
Every layer executes on your machine. Deterministic rules, contextual semantic chunking, and local open-weight safety models operate without external API dependencies.
Deterministic regex to local Llama Guard 3
Evaluates every inbound prompt, tool argument, and untrusted output across 21 high-confidence regex rules, structural heuristics, recursive Base64 decoding, in-place secret redaction, and local MLCommons hazard classification (S1-S15).
Contextual retrieval & 3-hop attack lineage
Cuts policies at semantic valleys (< 0.38 cosine), injects Anthropic-style contextual prefixes, and reranks with ColBERT Late-Interaction MaxSim. Correlates multi-turn tool traces to catch credential exfiltration chains (MITRE AML.T0048).
Behavioral loop detection & budget shields
Enforces hard ceilings on tokens, iterations, USD cost, and consecutive tool errors. Actively detects infinite A-B-A-B tool oscillation, repeat argument cycling, and sliding-window entropy collapse with automatic SIGTERM termination.
Standardized MCP host & permission gateway
Exposes 3 built-in MCP servers (firewall, breaker, lineage) over stdio, SSE, and Streamable HTTP JSON-RPC 2.0. Enforces strict least-privilege boundaries across external connectors (read-only Postgres, scoped GitHub, allowlisted Fetch).
From prompt to verified verdict
in four stages.
Intercept
Hooks observe user prompts, pre-tool arguments, and tool outputs before execution occurs in OpenCode, Claude Code, or Codex CLI.
Sanitize
Secrets (AWS, GitHub, PEM keys) are redacted in place. Base64 is recursively unpacked and re-scanned for obfuscated payloads.
Correlate
Contextual RAG evaluates ColBERT MaxSim against MITRE ATLAS while the Knowledge Graph evaluates 3-hop exfiltration lineage.
Enforce
The policy voter selects the decisive action: allow, sanitize in-place, hold for operator approval, or immediately block.
Live telemetry,
lineage & approvals.
Shipped as a built-in React app served directly by the core service at http://127.0.0.1:8907/ with zero cloud dependencies.
Built for developers.
Loved by teams.
Every action evaluated
in real time.
Live stream of verdicts, in-place secret redactions, ColBERT threat similarity scores, and circuit breaker trip events across all active agent sessions.
Flexible local posture.
Zero LLM dependencies required
- 21 Tier-1 deterministic regex rules
- Base64 & homoglyph heuristics
- In-place secret redaction
- SQLite contextual RAG + GraphRAG
- Circuit breaker & loop shield
- AMOLED developer dashboard
Hardware-verified neural safety
- Everything in Lightweight Mode
- Local Llama Guard 3 (1B quantized)
- Anthropic-style Contextual RAG
- ColBERT Late-Interaction MaxSim
- Cloudflare Quick Tunnel + Auth Code
- OpenCode, Claude & Codex hooks
For teams & enterprise audits
- PostgreSQL pgvector similarity mirror
- Named Cloudflare Tunnel ingress
- Multi-agent session budget persistence
- OWASP & MITRE compliance report exporter
- Centralized SIGTERM kill switch
- Custom security policy corpora
Guard your AI agents
with zero cloud leakage.
Install with a single hardware-verified command. Works out of the box with OpenCode, Claude Code, OpenAI Codex CLI, and any Model Context Protocol host.