Editions and Runtime Guarantees

For: developers, security reviewers, and buyers who need one unambiguous answer to “what is free, what is paid, and what still holds if the agent is compromised?”

InnerWarden has two product editions. They share an agent decision model and dashboard contract, but they do not make the same security guarantee.

	Community	Enterprise
Primary job	Reduce risky agent actions before execution	Contain a compromised agent at the host boundary
Platforms	Linux, macOS, Windows	Linux for the kernel-enforced boundary
Privilege	Per-user; no root, sensor, or kernel component	Host installation; elevated privileges required
Agent layer	Command hook, direct check, local API, MCP proxy	Everything in Community
Host layer	None	Host sensor, eBPF telemetry, detectors, correlation, response
Kernel controls	None in the Community artifact	Agent-scoped Execution Gate and Secret Read Guard on supported BPF LSM kernels
Network control	MCP traffic inspection for wrapped local servers	DNS pre-authorization and host network detection
Evidence	Local Community decision history	Host decision chain, live outcome verification, external anchor support
Operations	One developer machine	Host, agent, workload, tenant, and fleet scope

"Everything in Community" means the Community binary, installed. Enterprise is the host half of one product; the agent half is Community itself. The host installer puts it in place and joins the two, so a watched server is never a server whose own agents are unguarded, and the agent-facing verbs (check, contain, graph, observe, allow, mute, serve, hook, llm) come from that binary rather than from innerwarden-ctl. Typing innerwarden reaches both: anything the free CLI does not own is forwarded to the host CLI, which is why every host command in these docs is written that way.

Machines with no host stack — laptops, dev boxes — still need Community installed directly. There is no server there to do it for them.

Community is useful, not a demo

Community is the free, cross-platform innerwarden binary. It provides:

• deterministic allow, review, and deny decisions for integrated commands;
• inspection and enforcement for local MCP traffic placed behind the proxy;
• guided agent discovery and opt-in monitor-mode wiring;
• AI Jail on supported environments;
• local agent activity, token intelligence where a reviewed local source exists, dashboard, alerts, and decision history.

Install Community. The trusted primary path is npm: a prebuilt binary with signed npm provenance from the registry, no sudo or root, no postinstall script, nothing runs at install time, and the same command on Linux, macOS, and Windows.

npm install -g innerwarden

Or run it once without installing:

npx innerwarden

Secondary methods are also available. Signed release, no Node required, on macOS or Linux:

curl -fsSL https://innerwarden.com/free | sh

On Windows PowerShell:

irm https://innerwarden.com/free.exe -OutFile innerwarden.exe

From source with Rust:

cargo install --git https://github.com/InnerWarden/inner-warden innerwarden

Community does not install the host sensor or a kernel control. Its direct check and local HTTP adapter are advisory unless the caller honors the verdict. Its command hook holds only where that supported hook is actually wired. Its MCP proxy holds only for the MCP servers placed behind it.

Enterprise assumes an earlier layer can fail

Enterprise adds the host stack and Active Defence. Its design assumption is that a prompt, dependency, tool result, or the agent process itself can be compromised.

On Linux, Enterprise can add:

• eBPF host telemetry and cross-layer correlation;
• an agent-scoped Execution Gate that denies an unauthorized binary at bprm_check_security;
• an agent-scoped Secret Read Guard that denies access to declared sensitive paths at file_open;
• DNS pre-authorization, verified response, binary-integrity checks, and restart supervision;
• host, agent, workload, and tenant attribution;
• tamper-evident decision history and external anchor verification.

Enterprise does not make a universal “kernel protected” claim. The kernel guarantee applies only when:

1. the host runs a supported Linux kernel;
2. BPF LSM is active;
3. the gate is scoped to the intended agent or workload;
4. observe mode has captured the legitimate workflow;
5. rehearsal reports no unresolved legitimate denial;
6. an operator explicitly enables enforcement; and
7. InnerWarden verifies the live kernel state rather than trusting configuration.

If any required state is missing, the dashboard must report unavailable, observe-only, degraded, or failed. It must not infer protection from an installed binary, a licence, or a configuration file.

What holds against which agent state

Agent state	Direct check / local API	Supported command hook	MCP proxy	Enterprise host and kernel boundary
Cooperative	Holds when called	Holds for wired commands	Holds for wrapped servers	Observes and enforces when active
Buggy or careless	Bypassable if not called	Holds for wired commands	Holds for wrapped servers	Holds for scoped host actions
Compromised or hostile	Bypassable	Holds only while the hook remains in path	Holds for traffic that cannot route around the proxy	Holds outside the agent process when the live controls are active

The Enterprise value is not “more rules.” It is the independent control boundary and the operational evidence that the boundary was actually active.

Agent discovery is not the same as agent-aware integration

InnerWarden can recognize supported agents from reviewed installation, process, or configuration markers. Enterprise host telemetry can also observe unknown processes. Neither fact alone means every action from every unknown agent carries semantic agent context.

For agent-aware command or tool policy, use one of the supported paths:

• a native agent hook;
• an MCP server wrapped by innerwarden proxy;
• the local HTTP adapter exposed by innerwarden serve; or
• a direct innerwarden check integration in a custom runner.

An unknown agent still benefits from Enterprise host detection and scoped containment after it is identified and attached to a workload boundary.

Source and distribution

The Community tier is open source (Apache-2.0) at github.com/InnerWarden/inner-warden: you can read and build the exact code. The paid stack (Pro and Enterprise) is source-available, not open source: shipped as signed binaries, with licensed source access for security review and audit under the InnerWarden Source-Available Licence. The presence of a host or kernel primitive in a source workspace does not mean it is part of the Community artifact or that a live Enterprise guarantee is active.

For installation details, continue to Install and First Run. For the exact bypass boundary of each agent layer, read AI Agent Guardrail. For safe activation, read Safe Observe and Allowlist.