I built grith because I kept approving agent actions I had not actually read. Claude Code, Codex and Aider all ask permission, then most of us hit auto-approve and hope. The agent is grading its own homework. grith sits underneath the agent at the OS level. On Linux it uses ptrace plus a seccomp-BPF pre-filter to intercept the security-relevant syscalls an agent makes and scores each against 18 filters in three phases: secret scanning (1,617 patterns), sensitive-path detection, egress policy, taint tracking and more. The matching layers are deterministic and there is no LLM in the enforcement path, so a prompt cannot talk the proxy out of a verdict. Median scoring time is 0.017ms. Under 3.0 runs. Between 3.0 and 8.0 the process freezes until a human reviews it. Over 8.0 gets an EPERM injected. It is one static binary, MPL-2.0, model-agnostic (Ollama, OpenAI, Anthropic, OpenRouter) and runs entirely locally. Wrapping a tool is one command: grith exec claude (Or codex, cline etc) The free tier is the whole security core, offline, no account and no phone-home, capped at two concurrent supervised sessions. Linux only today, Windows and Mac coming soon.

grith

Your agent decides what's safe. grith decides what runs.

Your agent decides what's safe. grith decides what runs.