Show HN: Grith – syscall-level supervision for AI coding agents on Linux

Grith, a new open-source syscall-level security supervisor for AI coding agents on Linux, intercepts every syscall an agent makes and scores it before execution, denying risky operations such as a Claude Code attempt to POST .env to an external host. The tool, available for Linux x86_64 and aarch64, offers eleven built-in profiles for tools like Claude Code, Codex, and Cursor, and includes supervision-escape enforcement by default as of v0.2.5.

grith is an OS-level security supervisor for AI coding agents. It intercepts every syscall your agent makes and decides what actually runs. Claude Code ships the feature, then tries to POST .env to an outside host. grith denies it at the kernel boundary. grith.ai https://grith.ai · Documentation https://docs.grith.ai · Security model https://grith.ai/security Install on Linux x86 64 or arm64 : curl -fsSL https://grith.ai/install | sh Wrap the agent you already use: grith exec -- claude-code "fix the failing test" Or run grith's own agent, with the same filters in front of every tool call: grith run "list every TODO in this repo" Every file read, shell command, network call, and process spawn is scored before the kernel executes it: | Score | Verdict | What happens | |---|---|---| | under 3.0 | allow | the call proceeds | | 3.0 to 8.0 | queue | the process freezes until you approve or deny it | | over 8.0 | deny | the call never runs | Nothing runs on a maybe. Eleven built-in profiles claude-code, codex, aider, cursor, cline, copilot, goose and others auto-allow each tool's routine work, so the queue only sees the calls worth your attention. Supported platforms, other install methods, and building from source | Platform | Architecture | Status | |---|---|---| | Linux | x86 64 | supported kernel 4.8+ | | Linux | aarch64 | supported kernel 5.3+ | | macOS | Apple Silicon / Intel | v2.0 - needs an Endpoint Security backend | | Windows | x86 64 | v2.0 - needs an ETW backend | The installer auto-detects your platform, verifies the SHA-256 checksum, and installs to ~/.local/bin . Pass --global to install to /usr/local/bin , or --version <version to pin a release: curl -fsSL https://grith.ai/install | sh -s -- --global You can also download a binary directly from the latest release https://github.com/grith-ai/grith/releases/latest , or build from source with Rust 1.88+ and Node 22+: git clone https://github.com/grith-ai/grith.git && cd grith && make dist Full build instructions are in the documentation https://docs.grith.ai . Every release ships a static musl binary with a SHA-256 checksum, a cosign keyless signature, a CycloneDX SBOM itself signed , and SLSA build provenance. If cosign is on your PATH, the installer verifies the signature against the release workflow's identity automatically - no flags needed. To verify by hand, see release verification https://docs.grith.ai . By default, nothing. The free tier runs entirely offline: no account, no telemetry, and the audit log stays in local SQLite. Paid tiers validate their licence against grith.ai roughly once a day, and sync audit records only until you turn that off with general.audit sync = false licence validation continues; air-gapped deployments disable it too . Supervision-escape enforcement is on by default as of v0.2.5: spawning something that hands work to an unsupervised peer systemd-run , docker , tmux reaches the review queue rather than running unseen. Non-interactive sessions have no one to ask, so they fail safe and deny - if a CI script legitimately delegates, permit the binary in its profile or set supervisor.enforce authority delegating spawn = false . Getting started https://docs.grith.ai - installation, configuration, and the CLI reference Security model https://grith.ai/security - the filter pipeline, scoring, and what it does not cover Supervisor profiles https://docs.grith.ai/docs/concepts/supervisor-profiles - per-tool allowlists and how to write your own CHANGELOG /grith-ai/grith/blob/main/CHANGELOG.md - including the bypass classes we have not closed yet Pull requests are welcome - start with CONTRIBUTING.md /grith-ai/grith/blob/main/CONTRIBUTING.md , which covers the CLA /grith-ai/grith/blob/main/CLA.md and the local setup. grith is developed in a private monorepo and exported here per release, so this repository's history is one commit per export rather than per change; PRs are reviewed on GitHub and applied upstream with attribution. Found a security issue? Please follow SECURITY.md /grith-ai/grith/blob/main/SECURITY.md rather than opening a public issue. Repository code: MPL-2.0 /grith-ai/grith/blob/main/LICENSE Pro and Enterprise capabilities ship in the same binary and are unlocked by signed licenses. Hosted billing, license issuance, and cloud sync infrastructure are not part of this repository.