grith is live

What it is

AI coding agents ask permission before acting, and then most of us switch on auto-approve, because reviewing forty prompts an hour is not a workflow. At that point the agent is approving its own actions, and the thing doing the approving is the same probabilistic model that a poisoned README or a clever prompt injection can steer.

grith takes a different position: the security decision should not live inside the thing being secured. It is an OS-level supervisor. On Linux it uses ptrace with a seccomp-BPF pre-filter to intercept security-relevant syscalls - file access, process execution, and network operations - and scores them against 18 filters in three phases: static checks, pattern matching (secret scanning with 1,618 patterns, egress policy, destructive-op detection), then contextual filters like taint tracking. The matching layers are deterministic, and there is no LLM in the enforcement path.

Three verdicts, always spelled out:

• ✓ ALLOW (score under 3.0) - the call proceeds
• ⏸ QUEUE (3.0 to 8.0) - the process freezes until a human reviews it
• ⛔ DENY (over 8.0) - EPERM is injected into the syscall return

Nothing runs on a maybe. Median scoring time is 0.02ms, so the routine calls you never wanted to review stay out of your way.

Try it

curl -fsSL https://grith.ai/install | sh

Then wrap the tool you already use:

grith exec -- claude-code "fix the bug"

Pre-built profiles for claude-code, codex, aider, goose, cline, and others auto-allow each tool's routine operations, so the queue only sees the calls worth a human's attention. There is also a built-in agent mode (grith run "fix the tests") that routes any OpenAI-compatible API or local Ollama model through the same pipeline - same filters, same thresholds, same audit log.

What shipped on the way here

The recent releases were about closing our own escape routes and widening where grith runs:

• v0.2.2 removed cold-start threshold widening. The first call in a session is scored exactly like the thousandth.
• v0.2.3 added enforcement for supervision-escape classes: authority- delegating spawns (systemd-run, docker, tmux, crontab and friends) and control-injection socket connects (session D-Bus, tmux, X11).
• v0.2.4 shipped native Linux arm64 support, stopped launch-directory trust from covering credential stores, and made the proxy score a file rename's destination, not just its source.
• v0.2.5 turned that escape enforcement on by default. A supervisor that ships its sharpest protections disabled is not one we would run. It escalates to the review queue rather than denying outright, and read-only invocations like docker ps never prompt. Non-interactive sessions fail safe and deny, so a CI script that legitimately delegates needs a profile permit entry - that trade is in the CHANGELOG, along with the gaps we have not closed.
• v0.3.0 added privacy-preserving team analytics, workspace-only sharing, and D-Bus control-socket coverage.
• v0.3.1 added verifiable daily analytics archives and reduced prompt noise without weakening deny decisions.
• v0.3.2 made egress-rate state outcome-aware. Denied retry storms no longer count as delivered traffic, while repeated blocked-destination spread remains visible to policy.

The CHANGELOG and security policy also document gaps we have not closed. The supervised process tree is the enforcement boundary; delegating authority to a pre-existing process outside that tree is a structural escape class. grith detects known delegation routes, including common control sockets and delegating binaries, but does not claim to replace a VM or container for fully untrusted code.

What is free

The entire security core, forever: the proxy, all 18 filters, the supervisor, the quarantine digest, a local SQLite audit log, the CLI, and the dashboard on localhost:3141. No account, no phone-home, fully offline, bring your own model keys. The free tier is capped at 2 concurrent supervised sessions; the filters themselves have no limits.

The repository code is MPL-2.0. Paid tiers unlock team features - shared policies and configuration, provider-key sync, team analytics, and verifiable daily archives - via signed licenses.

Releases ship with cosign keyless signatures, SLSA provenance, a CycloneDX SBOM, and SHA-256 checksums, and the binary is static musl you can build yourself.

Scope, stated plainly

Linux only today: x86_64 (kernel 4.8+) and aarch64 (kernel 5.3+, shipped in v0.2.4) - so Graviton and Ampere instances, arm64 VPSes, and a Raspberry Pi 4 or 5 on a 64-bit OS all work. macOS (via the Endpoint Security framework) and Windows (via ETW) are v2.0 work. The install script errors out cleanly on unsupported platforms rather than pretending.

Why we think this layer has to exist

We did not start with a product thesis; we started with traces. Running Claude Code and Codex under strace on identical tasks, Claude Code attempted 752 reads of /proc/*/environ in one benchmark run - the methodology and scripts are public. Later, while dogfooding, grith froze a Codex session that had started sweeping the disk for credentials during a routine task.

Not malice. Just capable agents with your whole machine as ambient authority, and nothing underneath them until now.

What we want from you

Break it. The queue thresholds, the profiles, the escape classes we missed - file an issue or reply to anything we post. If you want macOS, there is a pinned issue to register interest so we can prioritise with real numbers.