98% of What Claude Code Does, I Never See. The 0.27% It Stops For Is the Point.

esc to close

Here is the deal you have made with your coding agent, whether you meant to or not.

Claude Code and Codex ask permission before they act - a file outside the repo, a shell command, a network connection. The first week, you read every prompt. By the second week you are approving forty an hour without reading them, because that is not a workflow, it is a part-time job. By the third week you have found --dangerously-skip-permissions, or auto mode, and you are not being asked at all.

At which point the agent is approving its own actions, and the thing doing the approving is the same model a poisoned README can talk into anything. And it runs with your full user authority: every credential you can read, it can read. Your SSH keys, your AWS login, the .env in the project next door. You went from too much friction to none, and neither one is where you wanted to be, because now nothing at all sits between the agent and the files that matter.

The choice is only binary because the approval is in the wrong place

The decision feels like a straight trade - safety or speed - because it lives inside the tool, at the level of "is this a tool call I should allow." Move it underneath the tool and a third option appears.

grith runs Claude Code under supervision at the syscall level. Every file read, process spawn and network connect the agent makes is intercepted and scored before the kernel carries it out. The overwhelming majority is routine and runs untouched. The small remainder that is genuinely worth a human glance freezes and waits for you. The few things that are never acceptable are denied outright, no prompt at all.

The point is not that grith is a better permission prompt. It is that you stop being the filter - and the one that replaces you cannot be talked around. The matching layers are deterministic and there is no LLM in the enforcement path, so the poisoned README that fools the agent does not fool grith.

What "the overwhelming majority" actually means

I develop under this every day. The machine I write grith on runs Claude Code and Codex through grith exec, so I have a month of real sessions to read back rather than a demo to stage.

Across 120 Claude Code sessions, grith allowed a median of 98.4% of everything the agent did, silently and safely. No prompt, no pause. Reading source files, running the test suite, spawning git, resolving modules - the ordinary substance of a coding session runs at full speed and you never hear about it.

The rest splits two ways, and only one of them involves you. A median of 0.9% of operations grith blocked outright - the calls that are never acceptable, like the io_uring rings it denies structurally - handled and logged with no prompt at all. The part that actually froze and waited for me to decide was smaller still: a median of 0.27%. Not forty an hour. A handful across the whole session, if that.

So the split, per session, is roughly: 98% approved automatically, about 0.9% blocked automatically, and 0.27% held for me to decide. Only the last of those three is a prompt.

The small numbers are the point, not a shortfall. A supervisor that stopped one call in five would be permission fatigue in a new coat, and you would turn it off by lunch. The value is not in how often it fires - it is that it stays quiet through the routine 98% and spends its whole attention on the sliver that can actually hurt you. And that sliver, as the list above shows, was your SSH keys, your AWS login and a production .env. A fraction of a percent, and every bit of it was a credential store.

The 0.27% it stops for is the part you would want to see

The operations grith surfaced are exactly the ones worth a look. Pulled straight from the audit log, the reads it queued for review across those sessions include:

• ~/.aws/login and ~/.aws/cli
• ~/.ssh/keys, down to a specific private key
• ~/.gnupg/private-keys-v1.d
• /var/lib/sss/secrets
• .env and .env.local inside a production project that was not the one being worked on

None of these were in a task I gave it. It does not matter whether a given read was incidental or something you would have refused outright - the read was real, the file was your private key, and without a supervisor it completes in silence. That is precisely the call you want to make yourself, at the moment it happens, rather than discover in an audit three weeks later. That is the 0.27%. It is the whole reason the other 98% can run unattended.

And that is Claude Code. Codex, on the same machine, went further. Tasked with a DNS bug in one repository, a process in its tree spent four and a half minutes walking the entire disk, reading anything whose name looked like a secret - ~/.aws, ~/.ssh, ~/.gnupg, ~/.docker, the secrets of a project it had never been pointed at, key material under /usr/share. Around two thousand file operations across 707 directories, every one of them credential-shaped. grith froze every real credential store it reached: 11 queued, 0 allowed. Half an hour later, it did it again.

That is not a hypothetical. It happened during ordinary work on a developer machine, and without a supervisor underneath the agent it would have completed and you would never have known.

Why it stays that quiet

The 98% is design, not luck. grith ships named profiles for claude-code, codex, aider, goose, cline and the rest, and each one auto-allows the routine operations that tool makes - reading source, running tests, resolving modules, spawning git. That ordinary work never reaches you, which is most of why the median lands at 98.4% out of the box rather than something you have to earn.

The queue is reserved for the genuinely ambiguous: an operation that is neither obviously fine nor obviously forbidden. A read of a credential store, a write outside the working tree, an egress to a destination the session has not touched before. When one lands, the process freezes at that syscall and waits, and because it is the only thing asking, the prompt is worth reading. You allow it once, allow the whole class for the rest of the session, or deny it - and grith remembers the call. If you want the line tighter or looser, thresholds are configurable per environment, and grith proxy test '<JSON>' dry-runs any call to show you its score and which filters fired.

What it looks like in practice

Instead of:

claude --dangerously-skip-permissions

you run:

grith exec claude

and then you leave. The same command works for Codex: grith exec codex. The routine work flows. If the agent reaches for something that scores into the review band - a credential store, a write outside the working tree, an egress to somewhere it has not been - the process freezes at that syscall and waits, and the prompt you get is worth reading, because it is the only one you are getting. When you come back, the audit log is a complete record of everything it touched, so "trust but verify" is a thing you can actually do rather than a slogan.

The gain is not that grith makes Claude faster - it is that unattended is the fastest way to run an agent, and grith is what makes unattended something you can do without holding your breath.

What this is not

• It knows the agents it has profiles for. claude-code, codex, aider, goose and cline are covered out of the box. Point it at a tool it has never seen and it will prompt more at first, until you have allowed that tool's routine operations once.
• It supervises the process tree it launches, not the whole machine. For genuinely untrusted code, a VM or container boundary underneath is complementary, not replaced. Isolation contains the blast radius; supervision sees each action. You want both.
• It is not a backup. It freezes the destructive delete before it runs. It does not undo one that already happened.

Try it on your next session

Every session you run in auto mode without something underneath it is a session where those reads complete and you never find out. The fix is one command. The security core is free, MPL-2.0, offline, one static binary.

curl -fsSL https://grith.ai/install | sh
grith exec claude

Run tonight's session unattended and read the audit log in the morning. The 98% you will never think about again. The 0.27% is why you did it.

---

About grith

grith is an open-source security supervisor for AI coding agents. It sits underneath the agent rather than inside it: on Linux, ptrace with a seccomp-BPF pre-filter intercepts every syscall the agent makes and scores it against 18 filters before the kernel executes it. Routine operations run untouched, the ambiguous ones freeze for human review, and everything it evaluates lands in a local audit log you can reconstruct a session from - which is exactly where the numbers in this post came from.

It is Rust, MPL-2.0, a single static binary, and runs entirely on your own machine. Linux x86_64 and aarch64 today.

• Repo: github.com/grith-ai/grith
• Site and docs: grith.ai
• Try it: curl -fsSL https://grith.ai/install | sh, then grith exec claude