# Golem > AI Detection and Response (AiDR) for agents. Golem sits in the path of every tool call: it detects hijacked or drifting agents, blocks or gates the dangerous calls before they execute, contains a compromised machine, and signs the evidence so the record cannot be edited afterward. Free public preview. Golem is AI Detection and Response for AI agents, the agent-layer counterpart to EDR for endpoints and NDR for networks. It has all three parts of that category, and being in the path is what makes the third one possible. - **Sensor (in-path).** Golem is the layer an agent's tool calls travel through: Model Context Protocol (MCP), agent hooks, SDKs and provider APIs. It is not a reader of log files after the fact. - **Detection (fast in the path, deep behind it).** The block decision is made in-process from a pre-compiled, cost-bounded CEL rule. No network hop, no model, no second round trip, nothing the agent waits on. Judgment happens behind the call, where a reviewer model reads what an agent said beside what it did, because misalignment is a property of that sequence. Enforcement runs at the speed of the call. Deep analysis runs only on the sessions that earn it. Reading payload bodies is its own opt-in switch, off by default. - **Response.** Let the call through, block it at the wire, hold it for human approval, or clamp a whole host to a locked-down toolset from the server. Containment is reversible by design. No detector is accurate enough to justify an irreversible action. Every action is hashed and signed as it passes (COSE_Sign1 over a canonical CBOR bill of materials), the raw payload goes to customer-controlled storage, and the hash goes to an append-only transparency log. That is the part of this stack a competitor cannot bolt on later. Elsewhere in the category a detection or a block is a claim in a log the agent's own host wrote. Here it is a signed entry the actor cannot rewrite. This file is the full content of https://golem.team in one fetch. For the short index, see /llms.txt. For the machine-readable agent capability catalog, see /.well-known/ai-catalog.json. ## Why this exists An agent with your credentials is a stranger with your keys. It reads untrusted content, calls tools and hits the network, headlessly and faster than you can watch. Three questions have no good answers today: - **Is this safe to touch?** A poisoned web page or PR comment can turn your agent against you. Nothing checks the URL or the tool call at the moment it fires. - **What did it actually do?** "An agent called an endpoint" is not evidence. Logs can be edited. After the fact, you cannot prove which agent, with what scope, touched what. - **What's even running?** Shadow MCP servers, unvetted tool calls, silent token burn. The agent surface grows faster than anyone's map of it. ## Every other AiDR tool's findings are claims in a log it controls Detection and response are only as good as the record behind them. "We blocked it" is a sentence. A signed, chained entry the actor cannot edit is evidence. The record of an action has to be captured by something *other than* the actor, and be tamper-evident, or it proves nothing. Planes have flight recorders the pilot cannot edit. Agents shipped with production credentials and skipped that step. Golem is that recorder. - **vs observability** (LangSmith, Langfuse, Datadog): those help you make the agent *better* from self-reported traces in a store you don't control. Golem proves what it actually *did*. - **vs other AiDR** (out-of-path sensors): those reconstruct the attack from logs the agent's own host wrote. Golem was *in* the call, so it can block, and prove the block *worked*. - **vs governance tooling** (policies, model cards): those do not survive a subpoena. A signed, tamper-evident record does, with the raw data still in your storage. That falls out of doing the security work. It is not the reason to buy. ## How it works: from the moment your agent acts to proof you can hand an auditor Golem sits inline, so every action your agent takes runs this path: 1. **Watch, from outside the agent.** Golem sits in front of everything your agent touches: its commands, its edits, its network calls, its AI-model traffic, even the browser. It watches from outside the agent, not from a library the agent controls. 2. **Check & gate, the moment it happens.** Because every call passes through it, Golem can let a call through, block it outright, or hold it for a human. The edit, the shell command, the deploy, the fetch to a sketchy host: each one is stoppable at the wire. This is the step only an inline layer can do. 3. **Record & seal, tamper-evident and machine-locked.** Every action is sealed with a cryptographic signature and linked to the one before it. Change any past record and the break is obvious. The signing key can be locked to the machine itself, so a signature ties to a real device. Nothing is lost, even if the network blips. 4. **Store: your data, your rules.** Raw payloads go where you choose: bring your own bucket (S3, GCS, Azure, or local) and Golem holds only hashes and signatures, or let Golem hold them encrypted at rest with a separate key per tenant so one workspace's data can't unlock another's. For the strictest bar, Tri-Secret Secure wraps each data key with a key in your own cloud KMS as well as ours. Neither side can read it alone, and revoking your key is a kill switch only you hold. Sensitive fields can be redacted (regex, policy, or optional NLP for names, emails, cards and SSNs) before anything is written, and the sealed record still verifies. 5. **Review & govern, in the console.** The Agentic Security Graph, a shadow-AI inventory, a review queue, and one-click compliance-evidence export. It flags ghost sessions, the ones that spawned a background process and then went dark. ## Security stories: how agents actually get hijacked Prompt injection doesn't need to breach your machine. It just needs your agent to read the wrong thing while it's holding your keys. Example: you ask your agent to check the review feedback on a PR; it pulls the comments with `gh`, and a comment an attacker left carries hidden instructions, now in your agent's context on a laptop already signed in to `gh` and `gcloud`. The instant the hijacked agent tries to leak a secret or open a backdoor PR, Golem gates the call before it leaves, and records the attempt so you see it even if you didn't notice. ## Capabilities: a full security stack, built for agents - **Captured, not self-reported.** Golem captures what your agents do from the outside: your IDE, your coding agents, your AI-model calls, even the browser. - **Tamper-evident record.** A permanent, append-only record. Every action is signed and linked to the one before it, so nothing can be altered or back-dated. Export the whole verified history in one click. - **Check & gate.** Golem checks the target of every call against known threats and your own policy, then lets it through, gates it, or hands it to a human, before anything happens. Then it records that the gate held. - **Safely.** A one-way safety lock. `/safely` restricts the agent to a safe set of tools, blocking edits, shell commands and the rest. Only a human can loosen it, never the agent. It locks tighter, never looser, so content that tries to hijack your agent can't widen its own reach. - **Your data stays yours.** Bring Your Own Bucket. Raw prompts and payloads live in your S3/GCS/Azure/local storage. Golem proves *that* it happened without ever holding the content. - **Hardware-backed keys.** Signatures can be bound to a key that never leaves real hardware, a TPM 2.0 on Linux or Apple's Secure Enclave, so a signature ties to a specific machine rather than a process. - **Agentic Security Graph.** The live topology of Hosts → Agents → MCP Servers → Tools, plus a shadow-AI inventory that surfaces MCP servers nobody registered. - **Ghost-session detection.** Flags sessions that spawned a background process (`nohup`, `&`, `tmux`) and then went silent. This is the runaway-cost pattern nobody notices until the bill lands. - **Verified agent attribution.** Each agent gets its own short-lived, revocable identity; the record shows exactly which agent did what, proven by the signature itself. - **Compliance evidence export.** One click turns the record into an auditor package: chain-of-custody, an integrity attestation, and control→evidence maps for SOC 2, ISO 27001 and EU AI Act Article 12. ## Works with your stack Golem rides the Model Context Protocol, so it wraps the tools you already run, usually in one line of config. No rewrite, no SDK lock-in. Supported surfaces include: Claude Code, Cursor, Windsurf, Antigravity, OpenClaw, LangChain, OpenAI Agents SDK, CrewAI, LlamaIndex, Semantic Kernel, the browser (ChatGPT · Claude.ai · Gemini), and the Anthropic · OpenAI · Gemini APIs. ## Same wire, two customers The agent adopts it for its own benefit; the human keeps it for control. Both live on one inline layer. - **The agent onboards for value** (headlessly, for free): a safety check on the URLs and tools it's about to touch before it acts; durable context and memory across runs; an answer to "is it safe to connect?" at action-time. - **The human / org stays for control** (once the agent is already using it): a tamper-evident record of everything the agent did; attribution (which verified agent, which scope); governance, flagging, and compliance-evidence export. ## AI-native: agents defending agents Whatever watches an agent cannot be the agent. Golem is AI-native to the core: every action is embedded and handed back through its own MCP server, so agents can investigate agents, and the rules that come out of it protect the whole fleet. - **Ask the record anything.** Every action is indexed the moment it happens, so an agent can ask in plain language what another agent did, replay a session, and confirm nothing was tampered with. - **Turn a finding into a rule.** Write a rule once ("never touch production right after reading untrusted content") and it watches every agent automatically. The whole fleet learns from one golem's catch. - **Safety that travels headless.** Safety verdicts and `/safely` clamps ride the same wire, so a rule earned on one host protects the next agent that connects. ## The defensible middle A sandbox asks "how much can it break?" Golem asks "should this action happen, and can you prove what did?" Prompt injection rides your agent's own credentials and permissions, so a sandbox cannot catch it. The question is what the agent is allowed to do, not how far it can reach. Golem stops an action and proves it happened from the same point inline. That signed, tamper-evident record is the kind of evidence EU AI Act Article 12, SOC 2, and ISO 27001 call for. ## Agent discovery and onboarding Golem exposes two capabilities to agents over MCP, discoverable via the Agentic Resource Discovery (ARD) catalog and authorized through standard OAuth (scoped, short-lived, revocable tokens): - **Golem Context**: search an agent's own conversation history, recall durable context, and pull artifacts from the tamper-evident ledger. - **Golem Safety**: an action-time verdict on whether a URL or tool target is safe to connect to, from aggregated threat intelligence. Discovery surfaces: - [ARD capability catalog](https://golem.team/.well-known/ai-catalog.json): machine-readable catalog of Golem's MCP capabilities. - [Agent registration guide (auth.md)](https://app.golem.team/auth.md): how an agent registers and obtains a scoped token, via Agent-Verified (headless), User-Claimed (device flow), and keyless Instant Trial. - [OAuth authorization metadata](https://app.golem.team/.well-known/oauth-authorization-server): RFC 8414 metadata for token, registration and device-authorization endpoints, plus supported scopes. - [App-hosted ARD catalog](https://app.golem.team/.well-known/ai-catalog.json): the live catalog served by the Golem control plane. ## Getting started Golem is in free public preview. Start at https://app.golem.team. Sign in with Google or email, set up in one line of config, and your data stays in your cloud. Contact: info@golem.team.