Run your agents in auto, without the worry. Golem is AI Detection and Response. It sits in the path of everything they do, catches the hijacked ones, stops the dangerous call before it runs, and contains the machine if it has to. Every action is signed on the way past, so what you're told happened is what happened.
Free while in preview · set up in one line · your data can stay in your own cloud.
The category
EDR watches endpoints. NDR watches networks. AiDR watches agents: software that reads untrusted text, holds real credentials, and acts without waiting for you. Doing it takes three things. You have to be in the path, fast enough to stay there, and right often enough to be trusted with a block.
Golem is the layer your agent's tool calls travel through: MCP, hooks, SDKs, provider APIs. Most of this category reads log files and local databases after the fact. That is a useful feed, and it is why those tools can explain an incident. Being on the call is what lets you end one.
The block decision is made in-process from a pre-compiled, cost-bounded rule. No network hop, no model, no second round trip, nothing your agent waits on. Judgment happens behind the call, where a reviewer reads what the agent said beside what it did. Enforcement runs at the speed of the call. Deep analysis runs only on the sessions that earn it.
Let it through, block it at the wire, hold it for a human, or clamp a whole machine to a locked toolset from the server. Every containment is reversible by design. No detector is accurate enough to justify an irreversible action.
Why this exists
It reads untrusted content, calls tools and hits the network, headlessly and faster than you can watch. Three questions have no good answers today.
A poisoned web page or PR comment can turn your agent against you. Nothing checks the URL or the tool call at the moment it fires.
“An agent called an endpoint” is not evidence. Logs can be edited. After the fact, you cannot prove which agent, with what scope, touched what.
Shadow MCP servers, unvetted tool calls, silent token burn. The agent surface grows faster than anyone's map of it.
Why ours holds up
Detection and response are only as good as the record behind them. “We blocked it” is a sentence. A signed, chained entry the actor cannot edit is evidence. Planes have flight recorders the pilot cannot touch. We shipped agents with production credentials and skipped that step. Golem is that recorder, and it is the part of this stack a competitor cannot bolt on later.
LangSmith, Langfuse and Datadog help you make the agent better, from self-reported traces in a store you do not control. Golem proves what it actually did.
Out-of-path sensors reconstruct the attack from logs the agent's own host wrote. Golem was in the call, so it can block, and prove the block worked rather than that it was attempted.
Policies and model cards do not survive a subpoena. A signed, tamper-evident record does, with the raw data still in your storage. That falls out of doing the security work. It is not the reason to buy.
Secure every tool & MCP call
Golem sits inline, so every action your agent takes runs this path. The highlighted step is the one only an inline layer can do: decide and record at the exact moment of action.
Golem sits in front of everything your agent touches: its commands, its edits, its network calls, its AI-model traffic, even the browser. It watches from outside the agent, not from a library the agent controls. Because it sits in the middle, it can act rather than only observe.
Because every call passes through it, Golem can let a call through, block it outright, or hold it for a human. The edit, the shell command, the deploy, the fetch to a sketchy host: each one is stoppable at the wire. Run /safely before a risky task and it locks the agent down to an allow-listed set of tools it cannot widen from inside the session. Plenty of products block things. Afterward, you can prove the block worked.
Every action is sealed with a cryptographic signature and linked to the one before it. Change any past record and the break is obvious. The signing key can be locked to the machine itself, so a signature ties to a real device. Nothing is lost if the network blips.
Raw payloads are split off and written to your own storage: S3, GCS, Azure or local. The hosted plane only ever holds hashes and signatures. Your data never leaves your infrastructure.
Open the console to the Agentic Security Graph, a shadow-AI inventory, an alerts queue and one-click compliance-evidence export. It also flags ghost sessions, the ones that spawned a background process and then went dark. The agent was headless. The human arrives to control.
Security stories · solved
Prompt injection doesn't need to breach your machine. It just needs your agent to read the wrong thing while it's holding your keys.
You ask your agent to check the review feedback on a PR. It pulls the comments with gh. A comment an attacker left after you opened it carries hidden instructions, now in your agent's context on a laptop already signed in to gh and gcloud.
The instant the hijacked agent tries to leak a secret or open a backdoor PR, Golem gates the call before it leaves, and records the attempt so you see it even if you didn't notice.
A full security stack, built for agents
Not an after-the-fact log. A control point on the call: it sees every action, stops the dangerous ones at wire speed, and turns the rest into evidence you own.
Golem captures what your agents do from the outside: your IDE, your coding agents, your AI-model calls, even the browser. A record the agent writes about itself is not evidence. This is.
from outside the agentA permanent, append-only record. Every action is signed and linked to the one before it, so nothing can be altered or back-dated. Export the whole verified history for an auditor in one click.
what · when · with what contextGolem checks the target of every call against known threats and your own policy, then lets it through, gates it, or hands it to a human, before anything happens. Then it records that the gate held.
before the action landsA one-way safety lock for a single run. /safely restricts the agent to a safe set of tools, blocking edits, shell commands and the rest. Only a human can loosen it, never the agent, so content that tries to hijack your agent cannot widen its own reach.
When a host looks compromised, contain it. Every new session on that machine comes up restricted, not just the run you were watching, until someone with the authority to clear it says it is safe. It keeps reporting the whole time, so evidence keeps arriving while its reach is cut. Revoking a key would stop the agent and the evidence together. This stops only the agent.
contains the host, not just the sessionThe same vocabulary describes what a teammate can do and what an agent can do, so you can compare them instead of translating between two systems. Grants are explicit and nothing implies anything else. Reading metadata never becomes reading prompts, and a write permission never becomes a delete. Nobody can hand out access they do not hold themselves, agents included.
people and agents, one vocabularyBring your own bucket and Golem never holds the content, only hashes and signatures. Or let Golem hold it, encrypted at rest with a separate key for every tenant, so one workspace's data cannot unlock another's. Deep analysis of payload bodies is its own switch, off until you turn it on.
BYO bucket · encrypted · per-tenant keys · body reads opt-inTri-Secret Secure: your data key is wrapped by a key in your cloud KMS as well as ours. Neither side can read it alone, and the moment you revoke our access the data goes dark. A kill switch only you hold.
CMEK · you hold the switchMask secrets and PII/PHI out of payloads the moment they are captured, with regex and policy on the agent plus optional NLP for names, emails, cards and SSNs. The sealed record still verifies. The sensitive data was never written.
regex · policy · NLPSignatures can be bound to a key that never leaves real hardware, a TPM 2.0 on Linux or Apple's Secure Enclave, so a signature ties to a specific machine rather than a process.
TPM 2.0 · Secure EnclaveThe live topology of Hosts → Agents → MCP Servers → Tools, plus a shadow-AI inventory that surfaces MCP servers nobody registered running on your fleet.
shadow-AI detectionFlags ghost sessions, the ones that spawned a background process (nohup, &, tmux) and then went silent. This is the runaway-cost pattern nobody notices until the bill lands.
Each agent gets its own short-lived, revocable identity. The record shows which agent did what, proven by the signature itself rather than claimed by the agent.
scoped · signed · revocableOne click turns the record into an auditor package: chain-of-custody, an integrity attestation, and control→evidence maps for SOC 2, ISO 27001 and EU AI Act Article 12.
SOC 2 · ISO 27001 · EU AI Act Art. 12Drop-in
Golem rides the Model Context Protocol, so it wraps the tools you already run, usually in one line of config. No rewrite, no SDK lock-in.
For agents and humans
The agent adopts it for its own benefit; the human keeps it for control. Both live on one inline layer.
The agent
// headlessly, for free
The human / org
// once the agent is already using it
AI-native · agents defending agents
Whatever watches an agent cannot be the agent. Golem is AI-native to the core: every action is embedded and handed back through its own MCP server, so agents can investigate agents, and the rules that come out of it protect the whole fleet.
Every action is indexed the moment it happens. An agent can ask in plain language what another agent did, replay a whole session, and confirm nothing was tampered with. No dashboard required.
ask in plain languageWrite a rule once, such as “never touch production right after reading untrusted content”, and it watches every agent automatically. The whole fleet learns from one golem's catch.
write once · watches everyoneSafety verdicts and /safely clamps ride the same wire, so a rule earned on one host protects the next agent that connects. Golems watching golems.
The defensible middle
A sandbox asks “how much can it break?” Golem asks “should this action happen, and can you prove what did?”
Prompt injection rides your agent's own credentials and permissions, so a sandbox cannot catch it. The question is what the agent is allowed to do, not how far it can reach. Golem stops an action and proves it happened from the same point inline. That signed, tamper-evident record is the evidence EU AI Act Article 12, SOC 2 and ISO 27001 call for, and isolation cannot produce it.
Golem is in free public preview while we figure out what teams need most. Start now, protect your agents, and see everything they do.
Sign in with Google or email · your data can stay in your own cloud
Questions, or need something Golem doesn't do yet? [email protected]