Architectural security for AI agents
Every tool call - file read, shell command, network request - passes through a multi-filter scoring proxy before execution. Not a wrapper. Not a prompt. An enforcement architecture.
Six design principles
Security decisions baked into the architecture, not bolted on after.
Every call evaluated
No operation executes without passing through the security proxy. Every file access, network connection, and process spawn is intercepted, scored, and gated.
Defence in depth
Multiple independent security layers ensure no single failure compromises the system. 18 filters across 3 phases.
Fail closed
Any proxy error, timeout, or unexpected condition results in DENY, not ALLOW. Security degrades safely.
Minimal privilege
Each supervised tool receives only the permissions defined by its profile. Routine operations auto-allow; everything else is scored.
Auditable
Every tool call, filter evaluation, score, and decision is logged in structured JSON. Full audit trail.
Enforcement convergence
Both execution paths route through the same proxy, filters, scoring engine, audit log, and digest system.
Two modes, one pipeline
Whether you run grith's built-in agent or wrap an external CLI tool, every operation flows through the same security proxy.
Built-in Agent
Grith's own LLM agent runs tool calls through the security proxy before execution. Every file read, shell command, and HTTP request is scored and gated.
- *Every tool call proxy-evaluated before execution
- *Profile-based allowlists scope permitted operations
- *Full audit trail with per-call scoring
$ grith run "fix the tests"
CLI Supervisor
Wrap any external tool - Claude Code, Codex, Aider - with grith exec. OS-level syscall interception routes every operation through the security proxy.
- *Linux x86_64 and aarch64 available now with ptrace + seccomp full interception
- *macOS support tracked for v2.0 (Endpoint Security port)
- *Windows support tracked for v2.0 (ETW + supervisor port)
$ grith exec -- claude-code "fix the bug"
Multi-Filter Security Proxy
Same filters, same scoring thresholds, same audit log, same digest system. Security policy is defined once and applies everywhere.
18 filters, 3 phases, one composite score
Tool calls flow through independent filter phases. Threats are caught early - most never reach the final scoring stage.
Every filter, explained
18 independent classifiers across three pipeline phases. Within each phase, all filters execute in parallel.
| # | Filter | Phase | Latency | Score |
|---|---|---|---|---|
| 1 | operation-risk Classifies tool call type and assigns base risk score | Static | <0.1ms | +1 to +4 |
| 2 | path-match Aho-Corasick pattern matching on file paths and arguments | Static | <0.1ms | +2 to +5 |
| 3 | sensitive-path-heuristic Heuristic detection of sensitive directories (.ssh, .env, credentials) | Static | <0.1ms | +1 to +4 |
| 4 | allowlist Exact match against user-configured allow and deny lists | Static | <0.1ms | -1 to +3 |
| 5 | argument Detects anomalous argument sizes and malformed structures | Static | <0.1ms | 0 to +2 |
| 6 | capability Validates operation against supervisor profile permissions | Static | <0.1ms | 0 or DENY |
| 7 | secret-scan Regex + entropy detection for 1,618 patterns (API keys, tokens, passwords) | Pattern | 1-3ms | +3 to +5 |
| 8 | command Shell command parsing for pipe chains, redirections, evals | Pattern | 0.5-1ms | +2 to +4 |
| 9 | egress-policy Controls outbound network destinations against trusted domain lists | Pattern | <0.1ms | +2 to +5 |
| 10 | dlp-gate Data loss prevention - detects and redacts sensitive data in outbound content | Pattern | 0.5-2ms | +3 to +5 |
| 11 | canary Detects access to planted canary files and honeytokens | Pattern | <0.1ms | +4 to +5 |
| 12 | destructive-action Hard-denies catastrophic host/storage destruction (disk format, raw device overwrite, recursive removal of a system root or database data dir) and escalates destructive operations against production targets | Pattern | 0.1-0.5ms | +3.5 to DENY |
| 13 | reputation IP/domain reputation lookup for network requests | Context | 0.5-2ms | -1 to +4 |
| 14 | behavioural Deviation from learned baselines for this user/project | Context | 1-3ms | +1 to +3 |
| 15 | taint Tracks data provenance - blocks tainted data exfiltration | Context | 0.1-0.5ms | +3 to +5 |
| 16 | session-containment Detects read-then-exfiltrate patterns within a session window | Context | 0.1-0.5ms | +2 to +4 |
| 17 | rate-limit Burst detection, frequency caps, statistical anomalies | Context | <0.1ms | +1 to +3 |
| 18 | egress-rate Tracks outbound request volume, unique destinations, and port scanning | Context | <0.1ms | +1 to +3 |
Filter latency ranges
AI agent kill chain detection
Grith maps agent behaviour to a 7-phase kill chain adapted from MITRE ATT&CK. Most threats are intercepted in the earliest phases.
What prompt injection looks like in practice
A malicious README tells your agent to exfiltrate SSH keys. No prompt, no alert - unless grith is watching.
Expected score distribution
1,000 simulated tool calls across a typical development session. The vast majority of operations are routine and pass automatically.
Designed to support your compliance workflows
Every tool call produces structured audit evidence. Map it to the framework your auditors require. Grith is not itself certified - it provides the data your auditors need.
SOC 2 Type II
Audit evidence for trust services criteria
NIST AI RMF
Structured data for all 4 functions
EU AI Act
Articles 9, 12, 13, 14, 15, 72
Security architecture, not a safety setting
Of the agent CLIs compared here, grith is the only one built around per-syscall security evaluation - open source, model-agnostic, and below the agent.
| Capability | grith | Cline | Aider | Open Interp. | Claude Code | Codex |
|---|---|---|---|---|---|---|
| Per-syscall interception | ✓ | coarse | container | |||
| CLI supervisor | ✓ | |||||
| Multi-filter scoring | ✓ | |||||
| Quarantine digest | ✓ | |||||
| Model agnostic | ✓ | ✓ | ✓ | ✓ | ||
| Local-first | ✓ | ✓ | ✓ | ✓ | ||
| Open source | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Cost tracking | ✓ | |||||
| Analytics & compliance | ✓ | |||||
| Encrypted team key sync | ✓ | |||||
| Multi-channel approvals | ✓ |
Try it yourself
One command. Watch the security proxy score its first tool call.
$ curl -fsSL https://grith.ai/install | shResponsible Disclosure
We take security vulnerabilities seriously. If you discover a security issue in grith, we ask that you disclose it responsibly.
- Email security@grith.ai with details of the vulnerability.
- Include steps to reproduce, affected versions, and potential impact.
- Allow up to 90 days for us to investigate and patch before public disclosure.
- We will acknowledge your report within 48 hours and provide regular updates on remediation progress.
Security Contact
For security-related communications, contact us at security@grith.ai. For PGP-encrypted communications, our public key is available upon request.
Security Advisories
Security advisories will be published on this page and in the project's GitHub repository. Subscribe to the repository releases to receive notifications.
For detailed architecture documentation, see the documentation site.