Skip to main content

Firewall & Bundled Vuln DB

Belay ships two host-control capabilities as default-on features: a native Rust firewall and a bundled vulnerability database. Both are implemented natively in Rust — no external tools are shelled out to (no clamd, no fail2ban, no nft/iptables command-line invocations). Everything runs in-process.

When this matters​

The tool-call boundary stops an agent from doing something dangerous. Host control adds a second dimension: constraining what reaches the network and knowing which of your installed dependencies carry known vulnerabilities — all without asking you to install or configure separate security daemons.

Native firewall​

The firewall talks to Linux netfilter/nftables directly through the native Rust rustables bindings rather than driving the nft or iptables binaries. Because there is no shell-out, there is no dependency on external firewall tooling being present or a particular version being installed.

Related Linux enforcement paths (inline egress via NFQUEUE, the optional eBPF sensor) sit in the same host-control layer. See belay firewall and belay egress for the runtime views.

One-click auto-setup (preview then confirm)​

The firewall supports two setup paths:

  • Manual — you author the ruleset yourself.
  • One-click auto-setup — Belay detects your environment, generates a sensible ruleset, and previews the exact changes before applying them. You confirm; nothing is written to netfilter until you say so.

Auto-setup is also offered by the setup wizard so a first run can turn on host firewalling without hand-writing rules.

warning

Host enforcement is fully active on Linux. On macOS the Linux-only enforcement layers (nftables firewall, NFQUEUE, eBPF) compile inert and degrade cleanly — the firewall views report an empty ruleset rather than failing — so the agent-defense core still works, but the firewall does not enforce. Windows support is still in progress. See Platform Support.

Bundled vulnerability database — no NVD key required​

Belay ships a per-ecosystem vulnerability database stored in an embedded Rust key-value store. It is bundled with the product: end users never supply an NVD API key and never configure an external feed to get baseline coverage.

  • The database is packaged per ecosystem, selected at build time (via BELAY_ECOSYSTEM) so the binary carries the advisory data relevant to your stack.
  • Lookups are local and offline — consistent with Belay's local-first, no-phone-home posture.
  • The open build ships a thin baseline seed of advisory data. It is enough to run key-free out of the box.
note

BELAY_NVD_API_KEY exists only for advanced / self-hosted feed generation. End users never need it — the bundled DB is the default and requires no credentials.

Exploitability signals: CISA KEV + EPSS​

Vulnerability reports do more than list CVE IDs. Each finding is annotated with two exploitability signals so you can triage by real-world risk, not just CVSS:

  • CISA KEV badge — flags advisories on the CISA Known Exploited Vulnerabilities catalogue, i.e. issues confirmed to be exploited in the wild.
  • EPSS % — the Exploit Prediction Scoring System probability that a vulnerability will be exploited in the near term, shown as a percentage column alongside the finding.

Together they let you sort a wall of CVEs down to "known-exploited and high-probability first."

note

Because coverage is bundled and key-free, vulnerability checks work on a headless VPS or an air-gapped host with no network calls and no credentials to manage. In the open build the KEV/EPSS columns render but show kev=false / epss=null unless enrichment data is bundled — the display is present, the enrichment ships with the curated feed.

Both are default-on​

The resident daemon enables the firewall and the vulnerability database by default. A standalone binary invoked without these features would otherwise start with an empty firewall, so shipping them on by default means the host controls are present the moment the daemon runs.