Runtime security for AI agents. Stops the tool calls that would delete your repo, nuke your shell, or leak your keys, then writes a tamper-evident, SHA-256 hash-chained audit trail you can verify with one command. Runs fully local: no signup, no telemetry, no API key.
You gave an AI coding agent terminal access so it could actually do work. But AI has senior engineer confidence and intern judgment.
- Agent hallucinates a variable? It runs
DROP TABLE users;. - Agent gets stuck in a loop? It force-pushes to
main. - Agent reads a poisoned webpage? It executes arbitrary shell commands.
By the time you realize what happened, your app is down.
No signup. No API key. No telemetry. Works offline. $0 forever.
Node CLI (protects Claude Code, Cursor, Codex):
npx grimdall init --hooksPython (LangChain, CrewAI, OpenAI Agents SDK, AutoGen):
pip install grimdallfrom grimdall import guard
@guard.wrap # That's it. Your agent is now blast-resistant.
def my_agent_function(prompt):
# your agent logic herenpx grimdall demo # watch it block rm -rf / live
grimdall audit:verify # prove the hash chain is intact
grimdall doctor # sanity-check your setupEvery tool call goes through the Grimdall core loop:
tool call → intercept → evaluate policy → allow / block / review → hash-chained audit
Default protections (out of the box):
- Blocks destructive shell calls:
rm -rfand fork bombs. - Blocks destructive SQL:
DROP TABLEandTRUNCATE. - Blocks path-traversal patterns (
..\). - Forces network commands (
curl) to human-in-the-loop review. - Secret masking (redacts API keys and tokens before they're written to the audit log).
- Prompt-injection detection (shell-destructive, SQL, and path-traversal patterns) with a weighted risk score.
The unique part: cross-language audit trail. Most tools support one language. Grimdall has a Node CLI and a Python runtime — both write to the exact same SHA-256 hash-chained, tamper-evident audit trail. Verify what your Python LangChain agent did using the Node CLI. Cryptographic proof of what was attempted, whether it was blocked, and when.
- Policy enforcement — declarative
allow/block/reviewpolicies with wildcard tool matching. - Secret masking — deep-clones call arguments and redacts OpenAI keys, AWS keys, GitHub tokens, bearer tokens.
- Injection detection — weighted risk score for shell-destructive, SQL-destructive, and path-traversal patterns.
- Human-in-the-loop Slack alerts — blocked calls can ping a Slack webhook in real time.
grimdall demo— watch it blockrm -rf /live.grimdall audit:verify— one command proves the chain is intact.- Trust layer — Ed25519 agent identity and signed intent capsules.
audit(shadow / learn-only mode): logs what would be blocked, blocks nothing. Run this for a week before switching.enforce: real blocking + review gates.
Switch with the CLI (grimdall mode audit → learn-only, grimdall mode enforce → hard enforcement). Start in audit, graduate to enforce.
Grimdall is a guardrail, not a force field. It reduces blast radius — it does not replace sandboxing, least-privilege credentials, or backups. Run agents with the smallest permissions possible, keep immutable backups, and treat
reviewactions as real decisions, not checkbox clicks.
Grimdall writes a tamper-evident, hash-chained record of every tool call it evaluates — the kind of evidence trail auditors ask for. Today you can verify integrity with grimdall audit:verify and inspect the log with grimdall audit:view. Grimdall is evidence infrastructure, not a certified compliance product.
- Spend guardrails — hard budget caps per agent (alert → review → block on token/cost spend).
- Industry policy packs — fintech/healthcare presets aligned to SOC 2 / HIPAA-style frameworks.
Apache-2.0 License. Built by a solo founder in India who got tired of being terrified of his own code. If this saved your prod database, give it a star. 🙏