Your agent decides what's safe. grith decides what runs.
Claude, Codex, Aider and friends approve their own actions with probabilistic models. grith sits underneath the agent and intercepts security-relevant syscalls - scoring the risky ones against 18 filters before they touch your machine. Every scored decision becomes a local audit record you can analyse by project, tool, and session.
$ curl -fsSL https://grith.ai/install | shMPL-2.0 source on GitHub. Free Community tier - no time limit. Linux x86_64 and aarch64. macOS and Windows tracked for v2.0.
A malicious README, a poisoned dependency, one clever prompt injection - and the agent is reading your SSH keys, with you out of the loop.
grith puts a supervisor with no LLM in its enforcement path between the agent and the OS. Risky calls are scored. Ambiguous ones wait for a human.
Wrap the agent. Keep the loop.
grith hooks the OS, not the app - so there's nothing to integrate. Start any agent through grith and every security-relevant call it makes is intercepted and either allowed, queued, or denied. Auto-approve stops meaning auto-trust.
Below the agent, not beside it
grith evaluates effects at the syscall boundary, below the model. Known limitations and bypass classes are published.
18 filters, every risky call
Secret scanning, sensitive-path detection, egress policy, destructive-op checks, taint tracking - scored in milliseconds.
Human review queue
Ambiguous calls pause and route to a reviewer. The agent waits. You decide. Nothing runs on a maybe.
Agent-agnostic
One supervisor for Claude, Codex, Aider, Cline, Goose and anything else that shells out.
Blocking is the start. The record is the product.
Every call that isn't routine is scored, decided, and written down. That turns agent activity into something you can understand by project, verify later, and use as evidence.
The fleet dashboard, team rollups, and verifiable daily archives are part of grith Pro - 14-day trial, no card required. See pricing
- allowed45,164
- queued2,731
- denied315
Project visibility
Activity, sessions, allow / queue / deny rates, average risk, and top filters by project and supervised tool.
Audit trails
A hash-chained local record of every scored call and verdict - integrity-checkable, replayable, and exportable.
Evidence-ready
Policy decisions, review outcomes, coverage, and configuration history structured for internal controls and audit workflows.
Private by design
Team rollups exclude prompts, commands, paths, source code, file contents, and model responses. Project names remain visible.
Latest writing
Technical work on AI agent security, syscall interception, and the trust boundary.
Codex Asks What Linux It Is Running On 96 Times to Say "ok"
We measured what Claude Code and Codex actually do when asked for a one-word reply, at the syscall level, across five cold runs each. Codex spawns lsb_release about 96 times per session, runs your login shell seven times, and reaches for io_uring nine times. Claude Code does the whole thing in four process spawns.
grith is live
The supervisor is out of the lab. One command installs it, one command wraps your agent, and security-relevant syscalls are scored before the kernel executes them. Here is what shipped, what is free, and exactly what it does and does not cover.
Supervising AI agents with seccomp-BPF and ptrace
How grith intercepts security-relevant syscalls from an AI coding agent without making it unusable: a seccomp-BPF pre-filter so the kernel only stops on calls worth scoring, TSYNC so every descendant inherits it, EPERM injection for denials, and a freeze-for-review verdict in between.