# InnerWarden

> Runtime guardrails for AI agents that can use the terminal, and a host EDR.
> It runs ON the host, OUTSIDE the agent: it screens risky commands and MCP/tool traffic
> before they run, blocks or flags dangerous behavior, and keeps the decision trail local.
> Kernel-enforced on Linux (eBPF/LSM); monitor mode on macOS and Windows. No cloud control
> plane. Source-available. Installs in observe-only / dry-run by default; the
> operator decides when to arm enforcement.

InnerWarden has two jobs. (1) **AI-agent guardrail** (the differentiator): prompt filters
control what an agent says; InnerWarden controls what it does. If an agent is tricked by a
poisoned file, web page, or pull request, the safety layer is not inside the thing being
tricked. (2) **Host self-defense**: kernel-level EDR (eBPF), 82 host detectors, cross-layer
correlation, MITRE ATT&CK coverage, and automated response (Linux full tier; macOS and
Windows run a lighter monitor tier).

## For AI coding agents: install & operate InnerWarden

There are two ways in, and they are for different moments. The **install skill** below takes a
machine with nothing on it to a verified install. The **agent guide** is for operating a host
that already has it. https://www.innerwarden.com/defend carries a one-paragraph prompt a human
can paste into you to start the first of those.

- [Install skill (public repo)](https://github.com/InnerWarden/innerwarden-skill): point a coding
  agent at this repository and tell it "install InnerWarden and verify it is actually screening
  my commands". It works out which machine it is on, installs the right way for it, wires the
  user's agent, and refuses to report success until `scripts/verify-install.sh` exits 0. That
  script does not check files exist: it sends real commands through the guard and reads the
  verdicts, because "installed" and "protecting you" are different claims and the gap between
  them is where most evaluations go wrong. Use this to INSTALL from zero.
- [Agent guide / AGENTS.md](https://www.innerwarden.com/agents.md): the authoritative playbook
  to install InnerWarden, configure it adapted to a specific machine, **safely** observe and
  allowlist what is normal on that host (verify-then-trust, never blind), answer the user's
  questions, and operate it. The installer also drops this on-box at `/etc/innerwarden/AGENTS.md`
  (version-matched to the installed binary).
- Install one-liner: `curl -fsSL https://innerwarden.com/install | sudo bash` (starts in
  observe-only, dry-run by default).

## For AI agents at runtime: ask InnerWarden before you act

- **MCP server (advisory front door):** `innerwarden agent mcp-serve` runs InnerWarden as an MCP
  server over stdio so your agent can ask, before acting: `innerwarden_check_command`
  (deny / review / allow), `innerwarden_check_ip`, `innerwarden_security_context`.
- **MCP enforcement (mandatory):** `innerwarden agent proxy --mode guard -- <mcp-server>` puts
  InnerWarden in the path of an agent's MCP tool calls so it can inspect, block, or kill them.
- **Direct (loopback, on the box, no credentials needed locally):**
  `POST http://127.0.0.1:8787/api/agent/check-command` returns a `recommendation` of
  deny / review / allow; `GET /api/agent/security-context`; `GET /api/agent/check-ip?ip=`.
- Capability catalog: [/.well-known/ai-catalog.json](https://www.innerwarden.com/.well-known/ai-catalog.json)

## Docs

- [Website](https://www.innerwarden.com)
- [GitHub repository](https://github.com/InnerWarden/innerwarden-releases)
- [README](https://github.com/InnerWarden/innerwarden-releases)
- [Wiki (install, operate, guard AI agents, extend, compliance)](https://www.innerwarden.com/defend)
- [Protect AI agents](https://www.innerwarden.com/protect-ai-agents)

## Working with InnerWarden (for agents)

- It is a guardrail, not an adversary. Cooperate with it; do not disable, uninstall, or bypass
  it to push a command through.
- Never blind-allowlist what is currently running (malware on the box is "currently running"
  too). Verify each candidate and ask the human to confirm anything ambiguous; the agent guide
  describes the exact safe observe -> baseline -> verify -> propose -> arm workflow.
- Do not probe `check-command` to find an evasion; every check is logged and alerts the operator.