Your agent decides what's safe. grith decides what runs.
Claude, Codex, Aider and friends approve their own actions with probabilistic models. grith sits underneath the agent and intercepts security-relevant syscalls - scoring the risky ones against 18 filters before they touch your machine. Every scored decision becomes a local audit record you can analyse by project, tool, and session.
$ curl -fsSL https://grith.ai/install | shMPL-2.0 source on GitHub. Free Community tier - no time limit. Linux x86_64 and aarch64. macOS and Windows tracked for v2.0.
A malicious README, a poisoned dependency, one clever prompt injection - and the agent is reading your SSH keys, with you out of the loop.
grith puts a supervisor with no LLM in its enforcement path between the agent and the OS. Risky calls are scored. Ambiguous ones wait for a human.
Wrap the agent. Keep the loop.
grith hooks the OS, not the app - so there's nothing to integrate. Start any agent through grith and every security-relevant call it makes is intercepted and either allowed, queued, or denied. Auto-approve stops meaning auto-trust.
Below the agent, not beside it
grith evaluates effects at the syscall boundary, below the model. Known limitations and bypass classes are published.
18 filters, every risky call
Secret scanning, sensitive-path detection, egress policy, destructive-op checks, taint tracking - scored in milliseconds.
Human review queue
Ambiguous calls pause and route to a reviewer. The agent waits. You decide. Nothing runs on a maybe.
Agent-agnostic
One supervisor for Claude, Codex, Aider, Cline, Goose and anything else that shells out.
Blocking is the start. The record is the product.
Every call that isn't routine is scored, decided, and written down. That turns agent activity into something you can understand by project, verify later, and use as evidence.
The fleet dashboard, team rollups, and verifiable daily archives are part of grith Pro - 14-day trial, no card required. See pricing
- allowed45,164
- queued2,731
- denied315
Project visibility
Activity, sessions, allow / queue / deny rates, average risk, and top filters by project and supervised tool.
Audit trails
A hash-chained local record of every scored call and verdict - integrity-checkable, replayable, and exportable.
Evidence-ready
Policy decisions, review outcomes, coverage, and configuration history structured for internal controls and audit workflows.
Private by design
Team rollups exclude prompts, commands, paths, source code, file contents, and model responses. Project names remain visible.
Latest writing
Technical work on AI agent security, syscall interception, and the trust boundary.
A Git Config Key Ran Code in Seven Coding Agents. The 2022 Fix Does Not Stop It.
core.fsmonitor turns a line of repository config into a shell command. Git shipped an opt-in mitigation in 2022 and it is widely cited as the answer. I reproduced the attack in three configurations: the 2022 setting does not block the path that hits AI coding agents. One vendor already found the defence that does.
An agent skill can hand a stranger your shell - hours after you installed it
Without runtime enforcement, installing an agent skill can amount to giving an unreviewed stranger your shell, repository and developer credentials - possibly hours after you installed it. The format needs a permissions manifest, but a manifest alone is not enforcement.
98% of What Claude Code Does, I Never See. The 0.27% It Stops For Is the Point.
Claude Code and Codex ask permission, then everyone switches on auto-approve and hopes. Across 120 real Claude Code sessions under grith, 98.4% of what the agent did ran silently - and the 0.27% it stopped to ask about was reads of AWS credentials, SSH keys and .env files, none of them in the task. Codex went further and swept the whole disk. Without something underneath the agent, those reads complete and you never find out.