Belay: A local firewall for AI coding agents Belay, an open-source local-first security layer, gates every tool call an AI coding agent makes, blocking destructive commands, secret leaks, and dangerous MCP tool calls in under 100ms with no LLM in the decision path. It auto-detects 11 agents including Claude Code, Codex, and Cursor, and supports two-way approval via Telegram, Discord, WhatsApp, Matrix, Mattermost, and Slack. The tool is defense-in-depth, not a guarantee, and uses pattern-based detection with known limitations. Your coding agent has full shell access. One prompt injection in a GitHub issue, one hallucinated rm -rf , one MCP tool response that isn't what it claims to be — and it's not a bug report anymore, it's your .env in a stranger's webhook or your home directory gone. Belay is an open-source, local-first security layer that gates every tool call an AI coding agent makes — blocking destructive commands, secret leaks, and dangerous MCP tool calls in under 100ms, with no LLM in the decision path, no cloud round-trip, and no phone-home by default. It auto-detects the agents you already run, blocks dangerous actions outright , escalates ambiguous-but-risky ones to you for a one-tap Allow / Deny in the terminal, the desktop app, or your phone , and notifies you when something happens. Secret exfiltration — .env files, API keys, SSH keys, and credentials belonging to other AI tools on the same machine Destructive commands — rm -rf / , curl … | sh , fetch→chmod→exec droppers — including common evasion shapes wrapper prefixes, compound chaining, heredocs, split/long flags Reverse shells and command-and-control egress MCP tool-response injection markers — flags embedded "ignore previous instructions"-style content in a tool's response, correlated with any secret-holding session that follows Supply-chain, persistence, privilege-escalation, and recon patterns Malicious agent skills — install-time gating plus ongoing drift detection, so a skill that's benign at approval time and swapped later gets re-caught Every rule is tagged with the OWASP Top 10 for Agentic Applications from OWASP's Agentic Security Initiative , OWASP LLM Top 10 , and MITRE ATLAS , and the static scanner emits SARIF 2.1.0 straight into your CI's code-scanning tab. Known limitation, stated plainly: command-gate detection is pattern-based, not a full sandbox — an interpreter-wrapped call that never surfaces a recognizable shell substring e.g. a destructive action expressed purely through a scripting language's own API can still slip through, and a bare network call to a cloud metadata endpoint outside a skill's context isn't yet a dedicated command-gate rule. Belay is defense-in-depth, not a guarantee. Most agent-safety tools protect one agent. Belay auto-detects and correctly instruments 11 — using the right native mechanism per agent, not a generic shim: | Agent | Interception | |---|---| | Claude Code | native hook | | Codex | native hook | | Cursor | native hook | | Hermes | native hook | | OpenClaw | exec policy | | Gemini CLI | config policy | | Goose | config policy | | Cline | MCP proxy | | Roo | MCP proxy | | Antigravity | MCP proxy | | Opencode | plugin | More agents land regularly — run belay detect to check yours, and see MCP proxy features below for wrapping any MCP server Belay doesn't natively recognize yet. Step away from your laptop — when a call is an Ask , Belay can send the prompt to a chat app and take your Allow/Deny reply back. Two-way on Telegram, Discord, WhatsApp, Matrix, Mattermost, and Slack ; notify-only on ntfy, Teams, WeCom, and webhooks . Enrolment is a one-time pairing code, and it's default-deny — only enrolled approvers can approve, and a prompt that goes stale is auto-denied, never auto-allowed. detect → protect → serve / desktop app │ │ │ │ │ └─ live status, triage, and Allow/Deny in the desktop UI │ └─ gate every tool call: Deny Ask Allow fail-closed └─ find the AI agents installed on this machine Belay gates each tool call deterministically. A Deny can never be downgraded by the dev-toolchain allowlist; an Ask waits for a human decision and denies on timeout. Run with --observe first to tune in log-only mode before enforcing. Broader than a command blocklist. Tools that only block destructive shell commands don't cover secret exfiltration, MCP tool-call abuse, malicious agent skills, or host-level egress. Belay gates all of them from one rule catalog. Gates the tool call, not just the shell. Belay sits at the agent's tool-call boundary across native hooks Claude Code, Codex, Cursor, Hermes , config policy Gemini, Goose , and an MCP proxy any MCP server — not one integration surface. Local-first, not a SaaS. No cloud dependency, no LLM in the decision path, no phone-home by default, self-hostable, and the AGPL-3.0 source is yours to read end to end — inspect exactly what it does before you trust it with shell access. Runtime gating at the tool-call boundary — native hooks for Claude Code, Codex, Cursor, and Hermes; config-policy for Gemini and Goose; exec-policy for OpenClaw. PostToolUse redacts secret-shaped strings from tool output. MCP proxy mcp-proxy — wrap any MCP server so every tools/call is gated; fail-closed. Also scans tool responses for embedded injection markers and alerts, correlated against any secret-holding session. Deterministic rule catalog — secrets, egress, destructive, RCE, supply-chain, persistence, priv-esc, recon, config-tamper, plus arm→sink and "lethal-trifecta" session correlation. Skill security scanning — a dedicated scanner for AI-agent skills: prompt-injection, SSRF/cloud-metadata theft, credential snooping, tool-description poisoning, and anti-refusal manipulation, checked at install time and on an ongoing directory watch with content-hash-keyed trust so a skill can't be swapped for something malicious after approval without re-triggering review. Human-in-the-loop approvals — Allow / Deny in the terminal, the desktop app, or a chat app see Approve from your phone approve-from-your-phone ; timeout denies. Explain & Advise — every verdict carries a plain-English "why is this risky / what to do" explanation. An optional AI explainer OFF by default, bring-your-own-key: local Ollama or a cloud provider can add a second opinion. It is advisory only — it never makes or changes a decision, and secrets/paths are redacted before anything is sent. Static pre-install scanner scan — patterns, AST, taint, YARA, and OSV analyzers with provenance-weighted scoring and SARIF output for CI. An optional --llm cascade can filter false positives; with no API keys it runs fully local and heuristic-only. Tamper-evident audit — a hash-chained audit log plus evidence build / evidence verify SHA-256 manifest over findings + SARIF . Honeypot canaries — decoy credential files that trip a Critical verdict on read or egress. Host control — a native Rust firewall and a bundled per-ecosystem vulnerability DB, with no external tools and no NVD key required . The vuln DB surfaces CISA KEV known-exploited badges and EPSS exploit-probability scores, and outbound destinations can be annotated with reverse-DNS + ASN / owner / country display-only — never gates . Desktop app Tauri 2, Windows/macOS/Linux — system-tray status, a live dashboard, real-time Alerts feed, per-agent protection detail, and privacy-safe notifications category only — never your paths or commands . Linux & macOS CLI : curl -fsSL https://dl.belay.secblok.io/install.sh | bash Windows desktop app, PowerShell 5.1+ : irm https://dl.belay.secblok.io/install.ps1 | iex Prefer not to pipe a script for a security tool , understandably — read it first, or grab a direct binary and verify its checksum yourself: Read before running curl -fsSL https://dl.belay.secblok.io/install.sh -o install.sh less install.sh && bash install.sh ...or download a checksummed desktop installer directly Windows: belay-setup-x64.exe macOS arm : belay-aarch64.dmg macOS Intel : belay-x64.dmg Linux .deb : belay-amd64.deb Linux AppImage : belay-amd64.AppImage https://github.com/SECBLOK/belay/releases/latest Every download is checked against a published SHA256SUMS / .sha256 before installing, refusing on a mismatch. The Windows and macOS installers are currently unsigned while a code-signing/notarization certificate is pending — Windows SmartScreen and macOS Gatekeeper may warn on first run "More info → Run anyway" / right-click → Open . Uninstall anytime with belay uninstall add --purge to also remove ~/.belay . Once installed, drive Belay with the belay binary already on your PATH or launch the desktop app, which walks you through the same flow : 1. See which agents are installed belay detect 2. Protect one in log-only mode first tune, no enforcement belay protect