What is grith

AI agents are making security decisions. That's the problem.

Claude Code, Codex, Aider, Cline, Goose - they all decide what is safe to run on your machine using a probabilistic model. Auto-approve modes do not remove the risk, they remove the prompts. A poisoned dependency or an injected instruction in a README is enough for the agent to read your SSH keys or post them somewhere, with you out of the loop.

grith sits underneath the agent and intercepts the file, process and network syscalls that can grant or leak authority, before they run.

What it does

• Intercepts every file read, file write, spawn and network call the agent makes, using ptrace and seccomp-BPF together. The agent is not modified, not recompiled, and not asked to cooperate.
• Scores each call against 18 filters in three phases. The composite is a plain sum of what matched, and some filters subtract, so a call can score below zero.
• Decides on that score. At or below 3.0 the call runs. Above 8.0 it is refused. What lands between is held and put to you.

The model never sees the gate. The filters are deterministic, they run outside the model's trust boundary, and they do not depend on the agent behaving honestly.

What it is not

• Not a model. grith does not generate code and does not decide what your agent should do.
• Not a sandbox. When grith allows a call, the real syscall runs against the real filesystem. Nothing is redirected or mocked. What grith judges is what gets touched, not what gets transferred: file contents are never inspected.
• Not a managed service. The audit log, the decisions and the review queue are all local, and on Community nothing about a session leaves the machine. Paid plans add a team dashboard, fed by decision counts, score distributions and session, project, profile and tool names - never by commands, file paths, file contents, prompts or model responses. grith analytics disable turns it off. grith does poll GitHub for a newer version; general.update_check = false turns that off.

Where it runs

Linux x86_64 (kernel 4.8 or newer) and Linux aarch64 (kernel 5.3 or newer). grith needs CAP_SYS_PTRACE, or Yama ptrace_scope set to 0 or 1 - Ubuntu and Debian ship 1, which is fine.

Where to go next

• Installation - one line, and what it verifies.
• Quickstart - from install to answering a real prompt.
• Choose your agent - the profile grith picks for your tool.
• The threat model - what grith stops, and what it does not.
• Three-phase pipeline - how the 18 filters compose.