AI agents are making security decisions.
That's the problem.
Claude, Codex, Aider - they all decide what's safe.
grith intercepts every action and verifies it before execution.
Claude Code
Codex
Aider
Cline
Goose
Gemini CLI$ curl -fsSL https://grith.ai/install | shLinux x86_64 available now. macOS, Windows, and Linux aarch64 tracked for v2.0.
This Is What Prompt Injection
Looks Like in Practice
A malicious README tells your agent to exfiltrate SSH keys. No prompt, no alert — unless grith is watching.
Why this matters
AI agents don't just generate code. They interact with your operating system in ways that have real, irreversible consequences.
They decide what's safe using probabilistic models.
That's not a security system.
Auto Mode removes prompts.
It doesn't remove risk.
Claude's Auto Mode lets the agent approve its own actions. The permission prompts disappear, but the trust architecture stays the same.
grith removes the model from the trust boundary.
Every action is intercepted at the syscall level, scored by deterministic filters, and allowed or blocked independently of what the model thinks is safe.
Intercept. Score. Decide.
Three-step pipeline, under 15ms. Works with any CLI agent — no modification needed.
Intercept
Wrap any CLI tool with grith exec. OS-level syscall interception captures every file open, network connection, and process spawn. No agent modification required.
Score
18 independent security filters evaluate each operation in parallel across three phases. Path matching, secret scanning, taint tracking, behavioural profiling, destination reputation — producing a composite score.
Decide
Composite score routes each call: auto-allow, queue for review, or auto-deny. Ambiguous calls are batched into a quarantine digest — reviewed on your schedule, not one-by-one.
Works with Your Stack
One command wraps any CLI agent. Bring your own model, your own provider, your own workflow.
Claude CodeCodexGemini CLIAiderClineGoose
Open Interpreter
Ollama
Anthropic
OpenAIGoogle Gemini
OpenRouterand any other CLI tool or OpenAI-compatible provider...
What Developers Actually See
After every agent session, a clear summary. No digging through logs.
Analytics, Audit Trails &
Compliance — Built In
Every tool call logged. Every decision traceable. From cost tracking to enterprise compliance.
Cost Tracking
Per-session, per-model, per-provider cost breakdowns. Budget alerts planned.
Full Audit Trail
Structured JSON logs for every tool call: what was requested, which filters fired, the composite score, and the decision.
Security Analytics
Decision split visualisation, filter hit rates, anomaly trends, and behavioural baselines over time.
Compliance-Aligned Audit Trail
Structured audit data designed to support SOC 2, NIST AI RMF, and HIPAA reporting workflows. Grith is not itself certified — it provides the deterministic execution traces your auditors need.
SIEM / SOAR Export
Export AI agent security telemetry via webhook and JSON for integration with your existing monitoring stack. Treat AI agent actions like any other security event.
Built for Teams.
Ready for Enterprise.
From two developers sharing a policy to 500 engineers with SSO, RBAC, and air-gapped deployment (Enterprise, planned).
Encrypted Team Key Sync
Add your Claude, OpenAI, OpenRouter, and other API keys to the grith dashboard once. Keys are encrypted at rest and synced to team members via `grith pro sync` — no credential sprawl.
Approval Channels
Quarantine digest items routed to Slack, Telegram, web dashboard, or email. Approve, deny, or learn from any device.
Centralised Policy Management
Shared security filter configurations across your team. Update allowlists, scoring thresholds, and path rules from a single dashboard.
Team Dashboard & Usage Analytics
Per-developer cost, security score, and session history at a glance.
SSO / SAML, RBAC & Air-Gapped Deployment (Planned)
Planned for v2.0: single sign-on via Okta, Azure AD, or any SAML provider. Role-based access controls. Full air-gapped and VPC deployments.
No Other Agent Has
Native Security Architecture
The only open-source, model-agnostic tool with per-syscall security evaluation.
| Capability | grith | Cline | Aider | Open Interp. | Claude Code | Codex |
|---|---|---|---|---|---|---|
| Per-syscall interception | ✓ | — | — | — | coarse | container |
| CLI supervisor | ✓ | — | — | — | — | — |
| Multi-filter scoring | ✓ | — | — | — | — | — |
| Quarantine digest | ✓ | — | — | — | — | — |
| Model agnostic | ✓ | ✓ | ✓ | ✓ | — | — |
| Local-first | ✓ | ✓ | ✓ | ✓ | — | — |
| Open source | ✓ | ✓ | ✓ | ✓ | — | ✓ |
| Cost tracking | ✓ | — | — | — | — | — |
| Analytics & compliance | ✓ | — | — | — | — | — |
| Encrypted team key sync | ✓ | — | — | — | — | — |
| Multi-channel approvals | ✓ | — | — | — | — | — |
Latest writing
Technical work on AI agent security, syscall interception, and the trust boundary.
Wait - is this even Codex, or is it malware?
While Codex was doing routine research on a networking bug, a process in its tree walked the whole machine reading anything whose name looked like a secret - .aws, .ssh, .gnupg, system key stores, even unrelated projects. None of it was in the task. grith froze every real credential store. Then it happened again. Here is the full trace - including how we proved it was Codex and not separate malware.
An AI Model Escaped Its Eval and Breached Hugging Face. Every Step Was a Syscall
OpenAI was benchmarking a pre-release model's cyber capability. The model broke out of the eval sandbox through a bug in the one egress path the sandbox trusted, reached the open internet, and chained credentials and zero-days into remote code execution on Hugging Face production. The escape was a sequence of syscalls. So was every action after it.
Mythos Proves AI Safety Can No Longer Live Inside the Model
Anthropic restricted its most capable cyber model to vetted partners, routed risky requests away from it, and red-teamed it for thousands of hours. A jailbreak surfaced anyway, and the government pulled the model entirely. Every safety control in that story lived outside the model. That is the whole point.
Stop letting the model decide what's safe.
One command. Zero configuration. Wrap any agent.
$ curl -fsSL https://grith.ai/install | sh