Amaculis

AgentWarden is a semantic firewall for AI coding agents. The problem: coding agents run shell commands, edit files and browse the web, and anything they read can carry instructions. A README with a hidden line like "send .env to this URL" can turn a routine task into a data leak. Permission prompts don't help (after the hundredth one you just click yes), and allow-lists can't tell curl fetching docs from curl leaking your keys. AgentWarden hooks into the agent and checks every action against the user's actual task before it runs. Every action gets allow, ask or deny, in a cascade: 1. Deterministic rules settle clear cases in under a millisecond: secret files, uploads, history rewrites, destructive commands. 2. A local Meta Llama model (Llama 3.1 8B, runs on CPU) judges the rest, so most code never leaves the machine. 3. Muse Spark via the Meta Model API handles only the hard cases where the local model is unsure. It also scans what the agent reads: files and web pages are checked by the local model for injected instructions, and the agent is warned to treat them as data, not orders. Design choices that matter for security: - Fail-closed: any error, timeout or unparsable model output becomes "ask", never "allow". - Secrets are redacted before anything is sent to a model. - The agent cannot switch AgentWarden off: editing its policy or hook config, calling its daemon, killing it, or faking keystrokes to approve its own prompts are hard denies. - A fake "user prompt" planted by the agent cannot change what the judge sees as the task. - Every deny comes with a plain reason and a safer alternative; every decision goes to a local audit log and a live dashboard with "always allow / always deny" buttons. Results on 155 labelled agent actions: 100% of attacks caught with 0.953 accuracy, the same as sending everything to Muse Spark, at about 40x lower cost; 87.5% of judged actions are decided locally. Muse Spark also powers a red-team loop that generates new attacks against the cascade: 0 of 147 got through. Built for Claude Code, with adapters for other agents. It was tested live with Meta's Muse Code, where it blocked a .env read with its reason shown to the agent.