LOCAL-FIRST · DETERMINISTIC · FAIL-CLOSED
Belay is a local security layer that sits at the tool-call boundary of your AI coding agents. It blocks the dangerous stuff outright, asks you about the rest, and never lets a single agent misstep leak your secrets or wreck your host — in under 100 milliseconds, with no LLM in the decision path.
Detect · Block · Notify — a defense and monitoring layer for AI coding agents.
curl -fsSL https://dl.belay.secblok.io/install.sh | bash
How Belay gates a tool call
WHAT IT DOES
Belay wires into your agents where it counts: every tool call, before it runs. Claude Code and Codex get native PreToolUse/PostToolUse hooks; any MCP server can be wrapped so its tools/call requests are gated too. One policy boundary, in front of everything the agent tries to do.
The decision engine is compiled-in rules, not a model. No network round-trip and no language model in the hot path — just a fast, repeatable verdict in under 100 milliseconds. And it is fail-closed: a timeout or an error becomes a deny, never an accidental allow.
Clear-cut danger is blocked outright. For the ambiguous-but-risky calls, Belay pauses the agent and asks you — right in your terminal, browser, or chat app — with an inline Allow or Deny. Do not answer in time? It denies. Deny always wins.
The static scanner inspects code before it ever runs on your machine — patterns, AST, taint, YARA, and OSV analyzers combine into a provenance-weighted score and an install/run recommendation. It emits SARIF 2.1.0, so it drops straight into your CI code-scanning. The same scanner also covers agent skills, so a malicious skill gets caught before it is trusted.
Every verdict is written to a hash-chained audit log: each row is cryptographically linked to the one before it, so tampering is detectable. Build a signed evidence pack on demand, and let planted honeypot canaries trip a critical alert the instant anything reads or exfiltrates them.
Host controls are built in, in pure Rust — a native firewall and a bundled vulnerability database, with no external tools to install and no NVD key to configure. Findings carry CISA KEV badges and EPSS exploit-probability percentages out of the box, and optional egress destination enrichment (reverse-DNS, ASN, owner, country) is display-only — it never gates.
Every verdict carries a plain-English explanation: why it is risky, and what to do instead. Turn on an optional BYOK AI explainer — local Ollama or a cloud provider of your choice — for a deeper look. Off by default, advisory only, and secrets/host paths are redacted before anything is sent.
Answer Allow/Deny prompts from Telegram, Discord, WhatsApp, Matrix, Mattermost, or Slack — not just the terminal. ntfy, Teams, WeCom, and generic webhooks get notify-only alerts. Pairing-code enrollment keeps it owner-gated, and a prompt that goes stale is auto-denied.
HOW IT WORKS
belay detectFinds the AI coding agents already installed on your machine and flags the risky settings they are running with.
belay protect <agent>Wires Belay in at the tool-call boundary. Start with --observe to tune out false positives, then switch to enforcing.
belay serveRuns a local API + live event stream on your machine, and the desktop app renders it: posture at a glance, activity triage, and a live feed — with pending approvals surfaced for a one-click Allow/Deny.
TRUST & STANDARDS