Wrap any agent — Claude Code, Cursor, Codex — in one command. See every API call, file, secret, and tool it touches, then control it: stop prompt-injection attacks, block data exfiltration, hold risky actions for approval, and cap runaway spend.
Agents have your keys, your shell, and no judgment. One poisoned web page or tool result and they'll exfiltrate, overspend, or go off-mission. Straight Chaos catches it at the egress chokepoint, no code change.
A scraped page tells your agent to ship your secrets to an attacker's host. Mirror flags any action driven by untrusted content, caught before it lands.
mirrorAn API key pasted into a prompt, a credential echoed into a tool call. The data firewall scans every outbound request and blocks the leak.
DLPYou asked it to fix a test; it's reading ~/.ssh and pushing to prod. The intent firewall refuses any action that doesn't serve the mission.
A loop that quietly burns $400 in tokens. Cap the budget per agent and halt before the bill, not after.
budgetsWrap your agent behind chaos guard. It proxies the agent's egress (every HTTP call, model API, tool, and file access) and applies your policy. Start in monitor mode to see the truth, then flip to enforce.
Allow, deny, or hold for human approval by host, path, SQL, the model it calls, even secrets in its prompts. Least-privilege for everything the agent reaches.
Scan every outbound request for secrets & PII (API keys, tokens, private keys, cards, SSNs) and block, mask, or tokenize them before they leave.
Goal-aware least-privilege: capture the agent's mission and refuse any action that doesn't serve it. Reading ~/.ssh is fine for an SSH task, off-mission for a PDF summary.
Flag a write to a host the agent learned only from untrusted content (the signature of a prompt-injection-driven action) with zero extra model calls.
The agent says "all tests pass." Did it run them? Receipts verify the agent's completion claims against the tool calls it actually made.
Cap tokens and requests per agent over a rolling window, shared fleet-wide. Halt a runaway loop before the bill, not after.
A tamper-evident, hash-chained record of how each agent actually behaved, exportable and mintable into a portable, Ed25519-signed conduct credential a third party can verify offline.
Red-team your agent's defenses: inject prompt-injection, hijack, and exfil-lure probes and score the result. Resilience as a number that goes up over time.
The discipline this was built on. Inject real faults (latency, loss, partitions, resource kills, cloud outages) at the kernel layer (eBPF), and degrade the agent's own model API to test how it copes. Advanced →
Wrap your first agent in minutes. Free for solo devs and small teams.