{"slug": "belay-a-local-firewall-for-ai-coding-agents", "title": "Belay: A local firewall for AI coding agents", "summary": "Belay, an open-source local-first security layer, gates every tool call an AI coding agent makes, blocking destructive commands, secret leaks, and dangerous MCP tool calls in under 100ms with no LLM in the decision path. It auto-detects 11 agents including Claude Code, Codex, and Cursor, and supports two-way approval via Telegram, Discord, WhatsApp, Matrix, Mattermost, and Slack. The tool is defense-in-depth, not a guarantee, and uses pattern-based detection with known limitations.", "body_md": "Your coding agent has full shell access. One prompt injection in a GitHub issue,\none hallucinated `rm -rf`\n\n, one MCP tool response that isn't what it claims to\nbe — and it's not a bug report anymore, it's your `.env`\n\nin a stranger's\nwebhook or your home directory gone.\n\n**Belay is an open-source, local-first security layer that gates every tool\ncall an AI coding agent makes** — blocking destructive commands, secret\nleaks, and dangerous MCP tool calls in under 100ms, with no LLM in the\ndecision path, no cloud round-trip, and no phone-home by default.\n\nIt auto-detects the agents you already run, **blocks dangerous actions\noutright**, escalates ambiguous-but-risky ones to you for a one-tap\n**Allow / Deny** (in the terminal, the desktop app, or your phone), and\nnotifies you when something happens.\n\n**Secret exfiltration**—`.env`\n\nfiles, API keys, SSH keys, and credentials belonging to*other*AI tools on the same machine**Destructive commands**—`rm -rf /`\n\n,`curl … | sh`\n\n, fetch→chmod→exec droppers — including common evasion shapes (wrapper prefixes, compound chaining, heredocs, split/long flags)**Reverse shells** and command-and-control egress**MCP tool-response injection markers**— flags embedded \"ignore previous instructions\"-style content in a tool's response, correlated with any secret-holding session that follows**Supply-chain, persistence, privilege-escalation, and recon** patterns**Malicious agent skills**— install-time gating plus ongoing drift detection, so a skill that's benign at approval time and swapped later gets re-caught\n\nEvery rule is tagged with the **OWASP Top 10 for Agentic Applications** (from\nOWASP's Agentic Security Initiative), **OWASP LLM Top 10**, and **MITRE ATLAS**,\nand the static scanner emits **SARIF 2.1.0** straight into your CI's code-scanning tab.\n\n**Known limitation, stated plainly:** command-gate detection is pattern-based, not a\nfull sandbox — an interpreter-wrapped call that never surfaces a recognizable shell\nsubstring (e.g. a destructive action expressed purely through a scripting language's\nown API) can still slip through, and a bare network call to a cloud metadata endpoint\noutside a skill's context isn't yet a dedicated command-gate rule. Belay is\ndefense-in-depth, not a guarantee.\n\nMost agent-safety tools protect one agent. Belay auto-detects and correctly\ninstruments 11 — using the *right* native mechanism per agent, not a generic\nshim:\n\n| Agent | Interception |\n|---|---|\n| Claude Code | native hook |\n| Codex | native hook |\n| Cursor | native hook |\n| Hermes | native hook |\n| OpenClaw | exec policy |\n| Gemini CLI | config policy |\n| Goose | config policy |\n| Cline | MCP proxy |\n| Roo | MCP proxy |\n| Antigravity | MCP proxy |\n| Opencode | plugin |\n\nMore agents land regularly — run `belay detect`\n\nto check yours, and see\n[MCP proxy](#features) below for wrapping any MCP server Belay doesn't\nnatively recognize yet.\n\nStep away from your laptop — when a call is an *Ask*, Belay can send the\nprompt to a chat app and take your Allow/Deny reply back. Two-way on\n**Telegram, Discord, WhatsApp, Matrix, Mattermost, and Slack**; notify-only\non **ntfy, Teams, WeCom, and webhooks**. Enrolment is a one-time pairing\ncode, and it's **default-deny** — only enrolled approvers can approve, and a\nprompt that goes stale is auto-denied, never auto-allowed.\n\n```\ndetect  →  protect  →  serve / desktop app\n  │           │              │\n  │           │              └─ live status, triage, and Allow/Deny in the desktop UI\n  │           └─ gate every tool call: Deny > Ask > Allow (fail-closed)\n  └─ find the AI agents installed on this machine\n```\n\nBelay gates each tool call deterministically. A **Deny** can never be downgraded\nby the dev-toolchain allowlist; an **Ask** waits for a human decision and denies on\ntimeout. Run with `--observe`\n\nfirst to tune in log-only mode before enforcing.\n\n**Broader than a command blocklist.** Tools that only block destructive shell commands don't cover secret exfiltration, MCP tool-call abuse, malicious agent skills, or host-level egress. Belay gates all of them from one rule catalog.**Gates the tool call, not just the shell.** Belay sits at the agent's tool-call boundary across native hooks (Claude Code, Codex, Cursor, Hermes), config policy (Gemini, Goose), and an MCP proxy (any MCP server) — not one integration surface.**Local-first, not a SaaS.** No cloud dependency, no LLM in the decision path, no phone-home by default, self-hostable, and the AGPL-3.0 source is yours to read end to end — inspect exactly what it does before you trust it with shell access.\n\n**Runtime gating at the tool-call boundary**— native hooks for Claude Code, Codex, Cursor, and Hermes; config-policy for Gemini and Goose; exec-policy for OpenClaw. PostToolUse redacts secret-shaped strings from tool output.**MCP proxy**(`mcp-proxy`\n\n) — wrap any MCP server so every`tools/call`\n\nis gated; fail-closed. Also scans tool*responses*for embedded injection markers and alerts, correlated against any secret-holding session.**Deterministic rule catalog**— secrets, egress, destructive, RCE, supply-chain, persistence, priv-esc, recon, config-tamper, plus** arm→sink**and**\"lethal-trifecta\"** session correlation.**Skill security scanning**— a dedicated scanner for AI-agent skills: prompt-injection, SSRF/cloud-metadata theft, credential snooping, tool-description poisoning, and anti-refusal manipulation, checked at install time*and*on an ongoing directory watch with content-hash-keyed trust so a skill can't be swapped for something malicious after approval without re-triggering review.**Human-in-the-loop approvals**— Allow / Deny in the terminal, the desktop app, or a chat app (see[Approve from your phone](#approve-from-your-phone)); timeout denies.**Explain & Advise**— every verdict carries a plain-English \"why is this risky / what to do\" explanation. An** optional**AI explainer (OFF by default, bring-your-own-key: local Ollama or a cloud provider) can add a second opinion. It is advisory only — it never makes or changes a decision, and secrets/paths are redacted before anything is sent.**Static pre-install scanner**(`scan`\n\n) — patterns, AST, taint, YARA, and OSV analyzers with provenance-weighted scoring and**SARIF** output for CI. An optional`--llm`\n\ncascade can filter false positives; with no API keys it runs fully local and heuristic-only.**Tamper-evident audit**— a hash-chained audit log plus`evidence build`\n\n/`evidence verify`\n\n(SHA-256 manifest over findings + SARIF).**Honeypot canaries**— decoy credential files that trip a Critical verdict on read or egress.** Host control**— a native Rust firewall and a bundled per-ecosystem vulnerability DB, with** no external tools**and** no NVD key required**. The vuln DB surfaces** CISA KEV**(known-exploited) badges and** EPSS**exploit-probability scores, and outbound destinations can be annotated with reverse-DNS + ASN / owner / country (display-only — never gates).**Desktop app**(Tauri 2, Windows/macOS/Linux) — system-tray status, a live dashboard, real-time Alerts feed, per-agent protection detail, and privacy-safe notifications (category only — never your paths or commands).\n\n**Linux & macOS (CLI):**\n\n```\ncurl -fsSL https://dl.belay.secblok.io/install.sh | bash\n```\n\n**Windows (desktop app, PowerShell 5.1+):**\n\n```\nirm https://dl.belay.secblok.io/install.ps1 | iex\n```\n\nPrefer not to pipe a script for a *security tool*, understandably — read it first,\nor grab a direct binary and verify its checksum yourself:\n\n```\n# Read before running\ncurl -fsSL https://dl.belay.secblok.io/install.sh -o install.sh\nless install.sh && bash install.sh\n\n# ...or download a checksummed desktop installer directly\n# Windows:      belay-setup-x64.exe\n# macOS (arm):  belay-aarch64.dmg     macOS (Intel): belay-x64.dmg\n# Linux (.deb): belay-amd64.deb       Linux (AppImage): belay-amd64.AppImage\n# https://github.com/SECBLOK/belay/releases/latest\n```\n\nEvery download is checked against a published `SHA256SUMS`\n\n/`.sha256`\n\nbefore\ninstalling, refusing on a mismatch. The Windows and macOS installers are\ncurrently **unsigned** while a code-signing/notarization certificate is\npending — Windows SmartScreen and macOS Gatekeeper may warn on first run\n(\"More info → Run anyway\" / right-click → Open).\n\nUninstall anytime with `belay uninstall`\n\n(add `--purge`\n\nto also remove `~/.belay`\n\n).\n\nOnce installed, drive Belay with the `belay`\n\nbinary already on your `PATH`\n\n(or launch the desktop app, which walks you through the same flow):\n\n```\n# 1. See which agents are installed\nbelay detect\n\n# 2. Protect one in log-only mode first (tune, no enforcement)\nbelay protect <agent> --observe\n\n# 3. Enforce\nbelay protect <agent>\n\n# 4. Run the local backend (the desktop app renders the UI)\nbelay serve\n```\n\nReview activity with `belay status`\n\n(the last audit rows) and `belay logs`\n\n(a longer\ntail).\n\n`belay serve`\n\nexposes alocal API + SSE backend on— it is not a web dashboard. The`127.0.0.1`\n\ndesktop appis the user interface. Enable boot-start with`belay install-service --enable`\n\n(systemd / launchd).\n\nContributors can build the single static binary from a checkout:\n\n```\ncargo build --release --bin belay\n```\n\nThe primary Linux target is a fully-static **musl** build (`--target x86_64-unknown-linux-musl`\n\n), which needs the musl toolchain — install `musl-tools`\n\n(Debian/Ubuntu: `sudo apt install musl-tools`\n\n) so `musl-gcc`\n\nis available.\n\nContributions are welcome — see [ CONTRIBUTING.md](/SECBLOK/belay/blob/main/CONTRIBUTING.md). Contributions\nrequire a CLA + DCO sign-off.\n\n| Platform | CLI | Desktop app |\n|---|---|---|\nLinux x86_64 |\nReleased — fully-static musl build, runs on any libc | Released — `.deb` / `.AppImage` |\nmacOS (Intel + Apple Silicon) |\nReleased | Released — `.dmg` , both architectures |\nWindows |\nReleased | Released — NSIS installer (unsigned, cert pending) |\nLinux aarch64 |\nComing soon | Coming soon |\n\n**How do I stop my AI coding agent from running rm -rf or other destructive commands?**\nInstall Belay and run\n\n`belay protect <agent>`\n\n. Destructive commands — including common\nevasion shapes like wrapper prefixes, compound chaining, and heredocs — are denied\noutright at the tool-call boundary before they execute.**Can an AI agent leak my API keys or .env secrets?**\nNot once protected — Belay's rule catalog denies reads/egress of secret-shaped strings\nand redacts them from tool output; honeypot canary files trigger a Critical verdict on\nany access.\n\n**Does Belay work with Claude Code, Cursor, Codex, Cline, and Gemini CLI?**\nYes — see [Supported agents](#supported-agents) for the full list and how each is\nintercepted.\n\n**What's the difference between an AI agent security tool and a network firewall?**\nA firewall controls network traffic; Belay controls what an *agent* is allowed to do at\nthe tool-call level — reading files, running commands, calling MCP tools — before any\nof it reaches the OS or network. (Belay also includes a native host firewall as one\nlayer among several — see [Features](#features).)\n\n**Is there an open-source alternative to a hosted AI-agent-safety SaaS?**\nYes — Belay's Community edition is AGPL-3.0-or-later, local-first, and self-hostable;\nno telemetry, no phone-home. See [Editions & licensing](#editions--licensing).\n\nFull docs live at ** https://belay.secblok.io/doc** (landing page:\n\n[https://belay.secblok.io](https://belay.secblok.io)) — guides, the complete CLI reference, and configuration.\n\nBelay is **open-core**.\n\n**Community**— everything above, free and open source under** AGPL-3.0-or-later**.** Enterprise**— a commercial license adds centralized capabilities: fleet management, organizations / multi-tenancy, device management & enrollment, cross-device correlation, SSO (OIDC) + SCIM, a hosted/curated advisory feed (EPSS + CISA-KEV enrichment), audit push, and compliance reporting.\n\nFor AGPL-incompatible use or the Enterprise edition, see [ COMMERCIAL-LICENSE.md](/SECBLOK/belay/blob/main/COMMERCIAL-LICENSE.md)\nor contact\n\n**.**\n\n[hello@secblok.io](mailto:hello@secblok.io)Published by **SECBLOK** (Secblok Pty Ltd) · [https://www.secblok.io](https://www.secblok.io)\n\nBelay is defense-in-depth for AI agents, not a guarantee. Review the docs for its documented limits (e.g. syscall-level prevention requires elevated privileges and is out of scope by design).", "url": "https://wpnews.pro/news/belay-a-local-firewall-for-ai-coding-agents", "canonical_source": "https://github.com/SECBLOK/belay", "published_at": "2026-07-27 14:11:46+00:00", "updated_at": "2026-07-27 14:23:18.088828+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools", "ai-tools", "ai-infrastructure"], "entities": ["Belay", "Claude Code", "Codex", "Cursor", "Hermes", "OpenClaw", "Gemini CLI", "Goose"], "alternates": {"html": "https://wpnews.pro/news/belay-a-local-firewall-for-ai-coding-agents", "markdown": "https://wpnews.pro/news/belay-a-local-firewall-for-ai-coding-agents.md", "text": "https://wpnews.pro/news/belay-a-local-firewall-for-ai-coding-agents.txt", "jsonld": "https://wpnews.pro/news/belay-a-local-firewall-for-ai-coding-agents.jsonld"}}