Let coding agents run. Stop the calls that shouldn’t.

AIDR checks every tool call your agents make against your policy before it runs, then reviews each session for risky behavior after. Built by RuntimeSec for teams putting Claude Code and Codex to work.

Book a demo See the install
  • Bash ls -la src/ — allowed
  • Read .env — blocked by the policy “No .env reads”
  • Bash git push --force — blocked by the policy “No force pushes”
  • Bash rm -rf ~/ — blocked by the policy “No recursive deletes”
  • Read ~/.ssh/id_rsa — blocked by the policy “No SSH key reads”
  • MCP tool on the unregistered server notes-sync — blocked by the policy “Unregistered MCP server”
  • Bash curl uploading .env to webhook.site — blocked by the policy “No uploads to request catchers”
  • Read docs/setup.md — allowed
Every tool call passes the checkpoint before it runs. Calls your policy forbids never execute.

Works with the agents your team already runs.

AIDR plugs into coding agents where they already live: the developer’s own machine. No proxy to route traffic through, no new IDE.

Live blocking

Checked before every tool call

  • Claude Code
  • Codex

Session review

Transcripts collected by the local agent

  • Claude Code
  • Claude Desktop
  • Cursor
  • Cline
  • Warp
  • Codex

Detection models

Bring your own key, stored encrypted

  • OpenAI
  • Gemini

Agents act where your other tools can’t see.

They run with a developer’s credentials, read whatever the web hands them and type into a real shell. These are the moves AIDR watches for in every session.

  • Secret file reads

    An agent opens .env, an SSH key or cloud credentials it was never asked to touch.

  • Piped installers

    curl … | sh runs code nobody reviewed, with the developer’s full access.

  • Destructive commands

    rm -rf ~, DROP TABLE, a force push or a kubectl delete: one call from real damage.

  • Injected instructions

    “Ignore previous instructions” hiding in a web page or file the agent just read.

  • Unvetted MCP servers

    A tool server nobody reviewed, flagged the moment an agent calls it.

  • Exfiltration endpoints

    Data on its way to a pastebin, a request catcher or a tunnel.

Move agents from pilot to everyday work.

Building with agents is the easy part. Trusting them with a real repository, real credentials and a real shell is what stalls the rollout.

Roll out with a policy security has approved
Write the rules once, in the console. Every enrolled machine follows them from the next tool call on.
Block a bad call instead of cleaning it up
A read of .env or a piped installer is refused before it runs, with the reason shown to the agent.
Catch what rules can’t describe
Whole sessions get a model review, so intent that no single command reveals still gets flagged.
Keep developers moving
If the platform can’t be reached, calls go through as normal. An outage never becomes a blocked developer.

Checked before it runs. On the record after.

AIDR adds a decision point between what an agent wants to do and what actually happens on the machine.

  1. 1

    Collect

    A small agent on each developer machine ships assistant session transcripts, deduplicated and spooled so nothing is lost offline.

  2. 2

    Detect

    Fast rules run on every session, then a model triage, then deeper reasoning for anything that looks suspicious.

  3. 3

    Block

    Before each tool call, the agent’s hook asks your policy. A deny stops the call and tells the agent why.

  4. 4

    Record

    Every block lands in Live decisions, and every change to a rule lands in the audit log.

Permissions let an agent in. Policy decides what it may do.

Tool allowlists answer one question: may this agent use the shell at all? AIDR answers the one that matters: may it run this command, on this file, in this project, right now.

Rules match on the tool, its arguments, the file path and the project, and the first matching rule decides.

Three tiers, one verdict you can check.

Cheap checks run on everything. Expensive ones run only where they’re needed, and every conclusion points back to the lines that caused it.

Rules

Every session, in under 5 ms

Deterministic patterns for destructive commands, secret reads, piped installers and unknown tool servers.

Triage

Every session, one fast model call

A quick pass that separates ordinary work from sessions worth a closer look.

Reasoning

Only when triage escalates

A deeper review that names the technique and cites the transcript lines it’s based on.

Secrets are redacted before any model sees a transcript. Each tenant’s data is isolated at the database layer.

A few lines. Enforced.

Enroll the machine once, then wire the agent’s hook. From the next tool call on, your policy is in the path.

Terminal Enforced 
# once per machine
$ aidr-agent enroll --token et_••••••••
$ aidr-agent hook install

# every tool call now asks your policy first
$ claude
✕ Read(.env) blocked: No .env reads

Next step

Walk through it with us.

Bring your agents, your repositories and the actions that worry you. We’ll show you the policy that stops them.

Book a demo

Try it on your machine.

Enroll one laptop, add a single deny rule, and watch the next matching call get refused.

Read the install

Already a customer?

Rules, live decisions, alerts and session reviews for your tenant are in the console.

Sign in