Tool-call boundary guard
Intercepts matched PreToolUse hooks for wired integrations so policy runs before shell, file, and selected tool actions execute.
All products
BetaDeveloper Security
AgentWall
A local-first safety layer for developer AI agents.
AgentWall is a cooperative tool-call-boundary guard for AI coding agents. It evaluates local policy before matched tool calls run, can ask or block, keeps a local audit trail, and binds the viewer to localhost. It does not protect your whole machine or every agent automatically.
Release status
AgentWall v0.4.0-beta.1 is available for Ubuntu.
This public beta is an installable, human-signed Ubuntu package. Verify it before installing.
- Ubuntu 24.04 amd64: download the signed Debian package, then install it with your system package manager.
- The SHA-256 manifest, Minisign signature, SBOM, dependency inventory, and provenance are published alongside the package.
- This package does not activate protection or modify Codex, Claude Code, or MCP configuration until you explicitly approve activation.
- macOS remains unavailable until a signed, notarized Apple Silicon artifact has passed its separate live-evidence gate.
- AgentWall has no automatic update channel today.
Current scope and evidence are published in the public capability matrix.
Install after downloading
sudo apt install ./agentwall_0.4.0-beta.1_amd64.debMinisign public key: RWQpDxCtUWCeUzwsHBDWUck9FihPyjwhpR91+e0eQDyGbI0BBDpQZzhQ
Privacy
Local-first in personal mode.
- Config, policy, audit data, and the local viewer stay on your machine by default.
- Personal mode does not upload agent activity. The optional anonymous check-in is off by default and sends no commands, paths, policy, or audit data.
- The local viewer binds to 127.0.0.1 only and reads your local audit store.
- Enterprise fleet dashboards and cloud upload are not part of the day-one personal product.
Capability matrix
Honest support labels for day-one surfaces.
AgentWall governs tool calls at wired hook boundaries. Labels below match the public capability matrix artifact hosted by Omnet for this release.
| Integration | Label | OS | Evidence note |
|---|---|---|---|
Claude Code Claude Code sessions with AgentWall hooks wired for PreToolUse, PostToolUse, and PostToolUseFailure. | Ask/block prototype Ask/block prototype — works in local synthetic tests or doctor self-tests; not cleared for broad supported labeling without live validation evidence. | Ubuntu 24.04 amd64 | Ask/block prototype only. It is not a supported release label until fresh live validation evidence is published. |
Codex Codex sessions with hooks wired in ~/.codex/hooks.json for PreToolUse and PostToolUse. | Ask/block prototype Ask/block prototype — works in local synthetic tests or doctor self-tests; not cleared for broad supported labeling without live validation evidence. | Ubuntu 24.04 amd64 | Ask/block prototype only. It is not a supported live-app guarantee until fresh live Codex validation exists. |
Canonical artifact: public-capability-matrix.json. Claude Code remains ask-block-prototype until support-promotion gates are fully evidenced.
Non-goals
What AgentWall is not.
- Whole-machine protection or all-agent coverage
- Tamper-proof local audit or absolute enforcement
- Complete prompt-injection prevention
- Unsigned auto-update or signed-release claims before those controls exist
- Enterprise fleet dashboard in the personal product
- DLP, EDR, Slack, or Teams enforcement in the day-one product
Common bypasses
Cooperative guard, not whole-machine enforcement.
- Shell, git, or editor use outside wired Claude Code or Codex sessions
- Agent tools outside the installed hook matcher
- Removing or editing hooks manually
- Personal-mode fail-open behavior when policy or approval infrastructure is unavailable
Local policy and audit
Stores config, TOML policy, and SQLite audit events on your machine. Personal mode sends no telemetry by default.
Ask, block, and observe
Deterministic allow, ask, and block decisions with terminal approvals where supported, plus post-action audit for wired hooks.
Repairable wiring
Doctor checks, install dry-runs, and status output show when hooks, policy, or audit health are degraded and how to repair them.
Contact
support@omnetsystems.com