{"slug": "show-hn-grith-syscall-level-supervision-for-ai-coding-agents-on-linux", "title": "Show HN: Grith – syscall-level supervision for AI coding agents on Linux", "summary": "Grith, a new open-source syscall-level security supervisor for AI coding agents on Linux, intercepts every syscall an agent makes and scores it before execution, denying risky operations such as a Claude Code attempt to POST .env to an external host. The tool, available for Linux x86_64 and aarch64, offers eleven built-in profiles for tools like Claude Code, Codex, and Cursor, and includes supervision-escape enforcement by default as of v0.2.5.", "body_md": "**grith** is an OS-level security supervisor for AI coding agents. It intercepts every syscall your agent makes and decides what actually runs.\n\nClaude Code ships the feature, then tries to POST `.env`\n\nto an outside host. grith denies it at the kernel boundary.\n\n[grith.ai](https://grith.ai) · [Documentation](https://docs.grith.ai) · [Security model](https://grith.ai/security)\n\nInstall on Linux (x86_64 or arm64):\n\n```\ncurl -fsSL https://grith.ai/install | sh\n```\n\nWrap the agent you already use:\n\n```\ngrith exec -- claude-code \"fix the failing test\"\n```\n\nOr run grith's own agent, with the same filters in front of every tool call:\n\n```\ngrith run \"list every TODO in this repo\"\n```\n\nEvery file read, shell command, network call, and process spawn is scored before the kernel executes it:\n\n| Score | Verdict | What happens |\n|---|---|---|\n| under 3.0 | allow |\nthe call proceeds |\n| 3.0 to 8.0 | queue |\nthe process freezes until you approve or deny it |\n| over 8.0 | deny |\nthe call never runs |\n\nNothing runs on a maybe. Eleven built-in profiles (claude-code, codex, aider, cursor, cline, copilot, goose and others) auto-allow each tool's routine work, so the queue only sees the calls worth your attention.\n\n## Supported platforms, other install methods, and building from source\n\n| Platform | Architecture | Status |\n|---|---|---|\n| Linux | x86_64 | supported (kernel 4.8+) |\n| Linux | aarch64 | supported (kernel 5.3+) |\n| macOS | Apple Silicon / Intel | v2.0 - needs an Endpoint Security backend |\n| Windows | x86_64 | v2.0 - needs an ETW backend |\n\nThe installer auto-detects your platform, verifies the SHA-256 checksum, and installs to `~/.local/bin`\n\n. Pass `--global`\n\nto install to `/usr/local/bin`\n\n, or `--version <version>`\n\nto pin a release:\n\n```\ncurl -fsSL https://grith.ai/install | sh -s -- --global\n```\n\nYou can also download a binary directly from the [latest release](https://github.com/grith-ai/grith/releases/latest), or build from source with Rust 1.88+ and Node 22+:\n\n```\ngit clone https://github.com/grith-ai/grith.git && cd grith && make dist\n```\n\nFull build instructions are in the [documentation](https://docs.grith.ai).\n\nEvery release ships a static musl binary with a SHA-256 checksum, a cosign keyless signature, a CycloneDX SBOM (itself signed), and SLSA build provenance. If `cosign`\n\nis on your PATH, the installer verifies the signature against the release workflow's identity automatically - no flags needed. To verify by hand, see [release verification](https://docs.grith.ai).\n\nBy default, nothing. The free tier runs entirely offline: no account, no telemetry, and the audit log stays in local SQLite. Paid tiers validate their licence against grith.ai roughly once a day, and sync audit records only until you turn that off with `general.audit_sync = false`\n\n(licence validation continues; air-gapped deployments disable it too).\n\nSupervision-escape enforcement is **on by default** as of v0.2.5: spawning something that hands work to an unsupervised peer (`systemd-run`\n\n, `docker`\n\n, `tmux`\n\n) reaches the review queue rather than running unseen. Non-interactive sessions have no one to ask, so they fail safe and deny - if a CI script legitimately delegates, permit the binary in its profile or set `supervisor.enforce_authority_delegating_spawn = false`\n\n.\n\n[Getting started](https://docs.grith.ai)- installation, configuration, and the CLI reference[Security model](https://grith.ai/security)- the filter pipeline, scoring, and what it does not cover[Supervisor profiles](https://docs.grith.ai/docs/concepts/supervisor-profiles)- per-tool allowlists and how to write your own[CHANGELOG](/grith-ai/grith/blob/main/CHANGELOG.md)- including the bypass classes we have not closed yet\n\nPull requests are welcome - start with [CONTRIBUTING.md](/grith-ai/grith/blob/main/CONTRIBUTING.md), which covers the [CLA](/grith-ai/grith/blob/main/CLA.md) and the local setup. grith is developed in a private monorepo and exported here per release, so this repository's history is one commit per export rather than per change; PRs are reviewed on GitHub and applied upstream with attribution.\n\nFound a security issue? Please follow [SECURITY.md](/grith-ai/grith/blob/main/SECURITY.md) rather than opening a public issue.\n\nRepository code: [MPL-2.0](/grith-ai/grith/blob/main/LICENSE)\n\nPro and Enterprise capabilities ship in the same binary and are unlocked by signed licenses. Hosted billing, license issuance, and cloud sync infrastructure are not part of this repository.", "url": "https://wpnews.pro/news/show-hn-grith-syscall-level-supervision-for-ai-coding-agents-on-linux", "canonical_source": "https://github.com/grith-ai/grith", "published_at": "2026-08-26 14:01:23+00:00", "updated_at": "2026-08-26 14:15:59.825226+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "developer-tools"], "entities": ["Grith", "Claude Code", "Linux", "SQLite", "Rust"], "alternates": {"html": "https://wpnews.pro/news/show-hn-grith-syscall-level-supervision-for-ai-coding-agents-on-linux", "markdown": "https://wpnews.pro/news/show-hn-grith-syscall-level-supervision-for-ai-coding-agents-on-linux.md", "text": "https://wpnews.pro/news/show-hn-grith-syscall-level-supervision-for-ai-coding-agents-on-linux.txt", "jsonld": "https://wpnews.pro/news/show-hn-grith-syscall-level-supervision-for-ai-coding-agents-on-linux.jsonld"}}