grith is an OS-level security supervisor for AI coding agents. It intercepts every syscall your agent makes and decides what actually runs.

Claude Code ships the feature, then tries to POST .env to an outside host. grith denies it at the kernel boundary.
grith.ai  ·  Documentation  ·  Security model

Quickstart

Install on Linux (x86_64 or arm64):

curl -fsSL https://grith.ai/install | sh

Wrap the agent you already use:

grith exec -- claude-code "fix the failing test"

Or run grith's own agent, with the same filters in front of every tool call:

grith run "list every TODO in this repo"

Every file read, shell command, network call, and process spawn is scored before the kernel executes it:

Nothing runs on a maybe. Eleven built-in profiles (claude-code, codex, aider, cursor, cline, copilot, goose and others) auto-allow each tool's routine work, so the queue only sees the calls worth your attention.

curl -fsSL https://grith.ai/install | sh -s -- --global

git clone https://github.com/grith-ai/grith.git && cd grith && make dist

Verifying a release

Every release ships a static musl binary with a SHA-256 checksum, a cosign keyless signature, a CycloneDX SBOM (itself signed), and SLSA build provenance. If cosign is on your PATH, the installer verifies the signature against the release workflow's identity automatically - no flags needed. To verify by hand, see release verification.

What leaves your machine

By default, nothing. The free tier runs entirely offline: no account, no telemetry, and the audit log stays in local SQLite. Paid tiers validate their licence against grith.ai roughly once a day, and sync aggregated analytics - counts, verdicts, risk and filter attribution, never commands, file paths, prompts or payloads - until you turn that off with general.audit_sync = false (licence validation continues; air-gapped deployments disable it too). The raw audit log never leaves your machine.

Supervision-escape enforcement is on by default as of v0.2.5: spawning something that hands work to an unsupervised peer (systemd-run, docker, tmux) reaches the review queue rather than running unseen. Non-interactive sessions have no one to ask, so they fail safe and deny - if a CI script legitimately delegates, permit the binary in its profile or set supervisor.enforce_authority_delegating_spawn = false.

Documentation

• Getting started - installation, configuration, and the CLI reference
• Security model - the filter pipeline, scoring, and what it does not cover
• Supervisor profiles - per-tool allowlists and how to write your own
• CHANGELOG - including the bypass classes we have not closed yet

Contributing

Pull requests are welcome - start with CONTRIBUTING.md, which covers the CLA and the local setup. grith is developed in a private monorepo and exported here per release, so this repository's history is one commit per export rather than per change; PRs are reviewed on GitHub and applied upstream with attribution.

Found a security issue? Please follow SECURITY.md rather than opening a public issue.

Licence

Repository code: MPL-2.0

Pro and Enterprise capabilities ship in the same binary and are unlocked by signed licenses. Hosted billing, license issuance, and cloud sync infrastructure are not part of this repository.