Golem preview
Capabilities

Everything Golem does, and how.

The category, the path every call takes, the full capability list, the sandbox, what agents load and read, the stack it works with, and the agents that investigate your agents.

Start free ▸ Back to the overview

The category

AI Detection and Response. We shipped it before the category had a name.

EDR watches endpoints. NDR watches networks. AiDR watches agents: software that reads untrusted text, holds real credentials, and acts without waiting for you. Doing it takes three things. You have to be in the path, fast enough to stay there, and right often enough to be trusted with a block.

In the path

On the call, not on the log

Golem is the layer your agent's tool calls travel through: MCP, hooks, SDKs, provider APIs. Most of this category reads log files and local databases after the fact. That is a useful feed, and it is why those tools can explain an incident. Being on the call is what lets you end one.

Fast, then deep

Wire speed in the path. Depth behind it.

The block decision is a local rule check, compiled ahead of time with a fixed cost limit. No network hop, no model, no second round trip, nothing your agent waits on. Judgment happens behind the call, where a reviewer reads what the agent said beside what it did. Enforcement runs at the speed of the call. Deep analysis runs only on the sessions that earn it. If the Golem agent is down, hooked calls run unchecked rather than stall your engineers, and golem doctor lists them. What fails open, and what you can make fail closed.

Response

Stop the call, then contain the host

Let it through, block it at the wire, hold it for a human, or quarantine a whole machine to a locked toolset from the server. What you catch once becomes a rule the fleet carries from then on. Every containment is reversible by design. No detector is accurate enough to justify an irreversible action.

Secure every tool & MCP call

From the moment your agent acts to proof you can hand an auditor.

Golem sits inline, so every action your agent takes runs this path. The highlighted step is the one only an inline layer can do: decide and record at the exact moment of action.

▹

Watch from outside the agent

Golem sits in front of everything your agent touches: its commands, its edits, its network calls, its AI-model traffic, even the browser. It watches from outside the agent, not from a library the agent controls. Because it sits in the middle, it can act rather than only observe.

●

Check & gate the moment it happens

Because every call passes through it, Golem can let a call through, block it outright, or hold it for a human. The edit, the shell command, the deploy, the fetch to a sketchy host: each one is stoppable at the wire. Run /safely before a risky task and it locks the agent down to an allow-listed set of tools it cannot widen from inside the session. Plenty of products block things. Afterward, you can prove the block worked.

✕ Edit src/app.ts · blocked ✕ evil-cdn.ru · blocked ⏸ held for approval
⛬

Record & seal tamper-evident · machine-locked

Every action is sealed with a cryptographic signature and linked to the one before it. Change any past record and the break is obvious. The signing key can be locked to the machine itself, so a signature ties to a real device. Nothing is lost if the network blips.

◱

Store BYOB · your bucket

Raw payloads are split off and written to your own storage: S3, GCS, Azure or local. The hosted plane only ever holds hashes and signatures. Your data never leaves your infrastructure.

▤

Review & govern the console

Open the console to the Agentic Security Graph, a shadow-AI inventory, an alerts queue and one-click compliance-evidence export. It also flags ghost sessions, the ones that spawned a background process and then went dark. The agent was headless. The human arrives to control.

A conversation in the Golem console: each tool call in order, with the prompt-injection check recorded between them.
One session, call by call, with each check recorded where it ran. From a real Golem workspace; hostnames, repositories and paths pixelated.

Security stories · solved

How agents actually get hijacked, and how Golem handles each one.

Prompt injection doesn't need to breach your machine. It just needs your agent to read the wrong thing while it's holding your keys.

The setup

You ask your agent to check the review feedback on a PR. It pulls the comments with gh. A comment an attacker left after you opened it carries hidden instructions, now in your agent's context on a laptop already signed in to gh and gcloud.

Golem

The instant the hijacked agent tries to leak a secret or open a backdoor PR, Golem gates the call before it leaves, and records the attempt so you see it even if you didn't notice.

Why ours holds up

Every other AiDR tool's findings are claims in a log it controls.

“We blocked it” is a sentence. A signed, chained entry the actor cannot edit is evidence. Planes have flight recorders the pilot cannot touch; Golem is that recorder for your agents, and it is the part a competitor cannot bolt on later.

vs observability

LangSmith, Langfuse and Datadog help you make the agent better, from self-reported traces in a store you do not control. Golem proves what it actually did.

vs other AiDR

Out-of-path sensors reconstruct the attack from logs the agent's own host wrote. Golem can prove the block worked, not just that it was attempted.

vs governance tooling

Policies and model cards do not survive a subpoena. A signed, tamper-evident record does, with the raw data still in your storage. That falls out of doing the security work. It is not the reason to buy.

vs a sandbox

A sandbox asks how much the agent can break. Prompt injection rides the agent's own credentials, so it breaks nothing a sandbox can see. Golem asks whether this action should happen, and records the answer.

✓ EU AI Act Art. 12 evidence ✓ evidence for your SOC 2 · ISO 27001 Cryptographically signed

A full security stack, built for agents

Detect, block, contain and prove, from one inline layer.

The sandbox · macOS

Jail every command. Send the riskiest work somewhere else.

Every shell command your agent runs goes through a jail in the Mac's own kernel, so a hijacked command can't read your keys or switch Golem off. And some work means reading what a stranger wrote: a page from an issue, a repo from a PR, a download nobody vetted. Your agent doesn't have to do that part on your laptop at all. It hands it to a locked-down child agent in a throwaway VM, and gets back an answer, a patch, and a list of everything the child tried that it wasn't allowed to.

Every command

A kernel jail around each shell command

Before a command from a Claude Code session starts, Golem puts it inside macOS's own sandbox. Private keys stay unreadable whatever they're called, as do shell history and git credentials. It can't rewrite your shell profile, the agent's hooks or Golem's settings, and secret-looking environment variables never reach it. ssh, git signing, Docker and cloud CLIs keep working.

on by default · in the kernel, not a wrapper
Lock it down

A rule can take a session off the network

When a rule fires (a likely prompt injection, a command the jail refused, a fetch from the web), it can lock the session down: no network, no credentials, and writes only inside the workspace, until a fresh session starts. Each rule chooses whether to, because people sometimes ask their agent to do exactly those things on purpose.

your rules decide
On the record

Every refusal signed, every gap counted

When the kernel refuses an operation, Golem signs which command it was, in which session, into the same record as everything else. The console's Sandbox page shows how many sessions ran jailed, what the jail refused, which sessions were locked down, and which commands ran outside the jail.

refusals · lockdowns · coverage
Hand it off

Three tools, and a skill that knows when

sandbox_browse reads an untrusted page. sandbox_run runs untrusted code and returns a patch for you to review. sandbox_open inspects an untrusted file. Golem installs a skill with them, so your agent reaches for them on its own when a link, a repo or a download looks like someone else's.

browse · run · open
Nothing to steal

A VM with no keys and one way out

What the child loads and runs happens in a fresh virtual machine with no credentials, none of your files beyond what you handed over, and no route to your network. Its only exit is Golem, which lets it reach the hosts your agent named and refuses the rest. The child itself is fenced to those few tools, so content that hijacks it finds nothing worth taking and nowhere to send it. Each VM is discarded when its work is done.

no credentials · only the hosts you allow
Still watched

Isolation holds the keys back. Golem still watches.

A VM doesn't catch an injection. It only limits what one can reach. So the child is an agent Golem watches like any other: each call it makes and each request its VM sends is signed into the same record, linked to the session that asked for it. The attempts it wasn't allowed come back beside the answer, so your agent and you both see what the content tried.

every attempt · in your record

The shell jail comes with the Golem agent on every Mac. The VM sandbox is one command, golem install, on Apple silicon with macOS 26 or later.

The Sandbox screen: share of shell commands jailed, commands refused by the jail, and refusals per day over a week.
The shell jail over a week: coverage, jailed commands, refusals per day. From a real Golem workspace; hostnames, repositories and paths pixelated.

What agents load, read and ship

Watch the three moments an attacker aims for.

An agent is compromised through what it loads before it starts, what it reads while it works, and what it leaves behind when it's done. Golem watches all three, and signs what it finds into the same record as everything else.

What it loads

A supply-chain scan of every agent's setup

A cloned repo can bring its own MCP server, hook or CLAUDE.md, and the agent loads it the next time it opens the folder. Golem reads what every agent on the machine is set up to load (Claude Code, Cursor, Windsurf, Gemini CLI, Claude Desktop, Codex) and alerts on a server or hook that pipes a download into a shell, hidden characters in an instruction file, a plain-http remote, or instructions to hide something from you. Plaintext credentials are reported by name, never by value. The same goes for what no agent in the workspace has touched before: an MCP server nobody approved, a tool nobody has run, or a repo nobody has worked in, like a fresh clone. Each can be let through, flagged the first time it shows up, or blocked until an admin approves it.

MCP servers · skills · hooks · instruction files · never-seen tools and repos
What it reads

A prompt-injection check on what comes back

An injection arrives in a fetched page, a search result or an MCP tool's output. Turn it on and Golem scores each of those with a small, open classifier trained for injections hidden in documents and tool output, then signs the verdict into the session. When it is close to certain, you get an alert, and Claude Code is told to treat that result as data, not instructions. Write a rule on the score and Golem can answer with a block instead, so the agent sets the result aside. The text itself is never stored with the verdict.

off until you turn it on · record, advise or block by rule
What it ships

Every commit, tied to the session that made it

When an agent commits, Golem writes that commit into the session's signed record: the full id, the branch and the repository, read from git's own log rather than from anything the agent reports. Quiet commits, chained commands and a checkout straight after all count. So "which session wrote this?" has an answer that was recorded when it happened.

commit · branch · repo · session

Drop-in

It already speaks to your stack.

Golem rides the Model Context Protocol, so it wraps the tools you already run, usually in one line of config. No rewrite, no SDK lock-in.

▸ Claude Code ▸ Cursor ▸ Codex ▸ Windsurf ▸ Antigravity ▸ OpenClaw ▸ Hermes Agent ▸ LangChain ▸ OpenAI Agents SDK ▸ CrewAI ▸ LlamaIndex ▸ Semantic Kernel ▸ ChatGPT · Claude.ai · Gemini (browser) ▸ Anthropic · OpenAI · Gemini APIs

And it reports into what you already watch

▸ Datadog ▸ Slack ▸ PagerDuty ▸ Opsgenie ▸ Email ▸ Your own webhook

For agents and humans

Same wire, two customers.

The agent adopts it for its own benefit; the human keeps it for control. Both live on one inline layer.

The agent

onboards for value

// headlessly, for free

  • A safety check on the URLs and tools it's about to touch, before it acts
  • Durable context and memory across runs
  • An answer to “is it safe to connect?” at action-time
  • What the rest of the fleet is already working on, limited to the repositories you name

The human / org

stays for control

// once the agent is already using it

  • A tamper-evident record of everything the agent did
  • Attribution: which verified agent, which scope
  • Governance, flagging, and compliance-evidence export

AI-native · agents investigating agents

An agent cannot investigate itself. It takes an army of golems.

Whatever watches an agent cannot be the agent. Your fleet works at machine speed and nobody staffs a review queue that keeps up with it, so Golem investigates at the same speed: its own investigators read the sessions your agents produce, reading what an agent said beside what it actually did. They are agents themselves. That is the point, and it is why their work is held to the same standard of proof yours is.

Reads the run

The session, not a summary of it

An investigator reads a session the way a reviewer would: what the agent was asked, what it said it was doing, and every call that followed. Intent next to action is where a hijacked run stops looking ordinary, and it is the comparison a log of calls alone cannot make. Sessions are picked up as they finish, so a finding does not wait for someone to open a dashboard.

what it said · beside what it did
Watched in turn

The investigator is an agent, so Golem watches it

It joins your workspace under its own identity, and everything it reads and everything it concludes lands in the same sealed record your agents' work does. You can see what it looked at, what it spent, and which conclusions you threw out. A verdict nobody is allowed to inspect is one more claim in somebody's log.

its own identity · in your record
Checked, then measured

A second reader before a person

A case file is read back before it reaches you: accept it, send it back for more, or hand it to a human who should see this one. Then the part that actually matters gets measured, how often a person agreed once they read it, shown beside what it cost. You set the monthly ceiling in dollars and it stops there.

agreement measured · spend capped
The Defender screen: the harness running end to end, its queues, and the stages from investigator to threat intelligence to the defender harness and SIEM output, with spend against a monthly ceiling.
The defender harness: investigators, threat intelligence and rule promotion, each switched on separately, spend against a ceiling. From a real Golem workspace; hostnames, repositories and paths pixelated.
A security case: detection, opening, acknowledgement and containment times, quick mitigations, and reportability checks for GDPR, NIS2, SEC 8-K and the EU AI Act.
A case: the clock from detection to containment, quick mitigations, and what may need reporting. From a real Golem workspace; hostnames, repositories and paths pixelated.

Your agents already have your keys.
Don't let them act unwatched.

Free while in preview. Install it on one laptop this afternoon, and see everything your agents do.

Start free ▸ Talk to the founder

Sign in with Google or email · raw data can stay in your own bucket