# Greywall

> See everything your AI coding agent does on your machine. One install, no config, no containers. Allow-by-default with opt-in ask and deny modes. Linux and macOS.

Greywall is an open-source CLI tool that wraps any AI agent (Claude Code, Codex, Cursor, Aider, and others) in a local observability + control layer. Users install once and then prefix their existing agent command with `greywall --` — no agent plugins, no Docker images, no config files, no rebuilds on code changes. The default lets the agent run while Greywall records every read, write, and outbound request in a live activity feed (GreyProxy dashboard). Stricter behavior — ask mode prompts and explicit deny rules — is opt-in via the Greywall config. Under the hood it uses five security layers on Linux (Bubblewrap namespaces, Landlock filesystem, Seccomp BPF syscall filtering, eBPF monitoring, and TUN+SOCKS5 network proxy) and four on macOS (Seatbelt sandbox, filesystem policy, log stream monitor, and proxy-based network control). Built by Greyhaven, licensed Apache 2.0.

## Key Features
- One-line install, zero-config run — prefix any agent with `greywall --`
- Works with every local coding agent (no agent-specific plugin required)
- Real-time activity feed for every read, write, and connection
- Allow by default; opt into ask mode or deny rules via config
- Filesystem visibility and opt-in deny rules per path
- Network visibility and opt-in deny rules via GreyProxy
- Command attempt visibility and opt-in blocking (pipes, chains, nested shells)
- Learning mode (auto-generates least-privilege templates from observed access)
- Syscall filtering (blocks 27+ dangerous system calls via Seccomp BPF)
- Dynamic allow/deny controls (adjust policies live without restarting)

## Links
- [Homepage](https://greywall.io)
- [Documentation](https://docs.greywall.io/)
- [GitHub](https://github.com/GreyhavenHQ/greywall)
- [Greyhaven (parent company)](https://greyhaven.co)

## Install
- Homebrew: `brew tap greyhavenhq/tap && brew install greywall`
- Curl: `curl -fsSL https://raw.githubusercontent.com/GreyhavenHQ/greywall/main/install.sh | sh`
- Go: `go install github.com/GreyhavenHQ/greywall/cmd/greywall@latest`

## Compatibility
Works with: Claude Code, Codex, Cursor, Aider, Goose, Amp, Gemini CLI, Cline, OpenCode, Copilot.
Platforms: Linux (3.8+), macOS.
License: Apache 2.0.