Made in
Europe
Europe
Europe
AI agents can execute commands, access files, browse the web, and use tools. Isonapse independently checks covered actions against your rules before they run, and creates signed evidence of control-plane authorizations. It runs on your infrastructure, not in an Isonapse cloud.
Runs locally · No Isonapse account · No telemetry to Isonapse
macOS on Apple silicon · Linux x86_64
Then follow setup for your host.
Install Agent Hook, then follow the setup guide for your host to connect it and start the local daemon.
Fresh installs start in Profile mode. Work normally while it learns; your written policy is advisory in this mode.
Review the suggested policy, then apply it to move to Enforce. Your rules set the boundaries for covered actions.
Host versions and capabilities differ. Codex can run tools unchecked if its adapter cannot start or its hook definitions are not trusted. See support and limits.
Set up your host →An illustrative Claude Code session in Enforce mode: a routine action passes, a sensitive action asks, and a blocked action stops. This scripted walkthrough runs no commands on your machine.
Fresh installs start in Profile mode. Follow the setup guide to connect your agent, review the suggested policy and switch to Enforce.
Three verbs run the whole system. Everything else is detail that lives in the docs.
You set the rules: what an agent may do, what needs a human, what is never allowed. Your rules are the source of truth, not the model's mood.
With the integration active, covered actions are checked before they run. Available controls depend on your host and the mode you choose.
Every allow, and every question you can approve, issued by the local daemon is signed into a tamper-evident record you can verify offline.
Every agent runtime has its own permissions and controls. But your security shouldn't depend entirely on which agent you choose.
An independent layer for supported hosts and reviewed adapters. Coverage follows each integration.
Reuse policies across supported agents, including repository-level policies you can version with your code. In Enforce mode, local learning reduces repeated interruptions without overriding explicit rules. Signed authorization records let you inspect the policy behind a decision and verify the evidence independently offline.
Host capabilities differ: Hermes and Codex turn approval requests into refusals. Coverage, hook trust and failure behavior depend on the integration.
We govern the agents you run. We never run them for you.
Where it stands today: direct integrations for Claude Code, Hermes Agent and pi ship now. The open-source Hook ADK connects other agents, including a reference adapter for OpenAI Codex CLI. See host support and limits.
Stop approving the same routine actions over and over. In Enforce mode, Isonapse can recognize familiar behaviour within your safety boundaries and flag unusual work for approval or refusal, depending on the host.
Malicious instructions can influence what an AI agent tries to do. Isonapse independently checks covered actions before execution, without asking another LLM whether to allow them.
Apply data protections on supported tool inputs and outputs, including masking, tokenisation and secret handling. Available protections depend on the host, configured policy and mode.
Generate signed, tamper-evident records of control-plane authorizations. Verify the evidence independently, without trusting an Isonapse cloud service. Local stops and daemon-unreachable prompts have documented receipt exceptions.
In Enforce mode, local learning helps familiar actions proceed with fewer interruptions, but it cannot override an explicit policy block. Enforcement decisions follow your rules, not another LLM's judgement.
These controls apply to covered actions through supported integrations. Agent Hook is not an operating-system sandbox.
Your policy, not the model's mood.
Built for enterprise scale, and honest about what ships when.
The roadmap extends local governance to teams: signed records in a shared view, policies as versioned logic, and broader fleet coordination over time. Signing stays on the machine that makes the decision.
Invited CE testers can already bring signed records from enrolled workloads into a shared view. Broader fleet capabilities remain on the roadmap.
The critical control path is deterministic policy and bounded local state: no network round-trip, no SaaS in the loop. After model setup, local enforcement works offline. Your agent or model provider may still need a network connection.
Structural and resource limits constrain covered activity locally. Hard model-spend controls require the separate provider-proxy path.
Start with local protection today. Bring signed activity into a team view with CE private beta; organisation-wide capabilities are on the roadmap.
One local policy engine for your coding agents. Connect a supported host and keep your rules, learned state and audit history on your machine.
Hermes Agent v0.20.0 and pi 1.0.3 / 1.0.4 are the supported releases. Codex requires a reference adapter you review and register; it can run tools unchecked if that adapter cannot start or its hooks are not trusted. Compare integrations.
Connecting your own agent? Explore the Hook ADK — the open-source Python and TypeScript toolkit.
Bring your team's signed agent activity into one self-hosted dashboard. Explicitly enroll workloads and review records with repository attribution.
Private beta · available to invited testersPlanned organisation-wide capabilities: SSO, organisational trust, fleet budgets and compliance reporting.
Coming Q1 2027
Swiss-engineered · Built for Europe
Isonapse is software you run, not a SaaS service you depend on. Policies, learned state and audit evidence stay within infrastructure you control. Enforcement doesn't depend on a remote Isonapse service, and Agent Hook sends no prompts, decisions or usage telemetry to Isonapse.
Start on your own machine today. Invited testers can extend to a self-hosted team view with Community Edition private beta. Setup downloads files from external services; your agent or model provider may separately process data. Read the local-operation details.
A private technical community for people building the agentic future.
A daemon is a process that runs in the background without needing to be constantly instructed or supervised. It quietly does the work that keeps a system alive. That is the mindset behind Isonapse Daemons: a small, focused group of experienced engineers, builders and technical thinkers working with AI agents and agentic systems.
Not another large community. Not another place to collect badges. We are starting small.
About the program →Tell us who you are, what you are working on, what drives you and how you believe you could contribute.
Apply to joinThe agent-tooling gold rush is full of overnight wrappers: a hook script, a regex, a dashboard. The thing that polices your agents has to hold up under adversarial review, not just a demo.
Scripted illustrations of security checks, not live test output. Pick a scenario to explore the expected behavior.
"Trust us" is replaced by "verify the record yourself." That isn't a metaphor for the witness chain. It is the witness chain.
What to know before installing.
Isonapse is an independent control layer for AI coding agents. It checks covered actions such as shell commands, file operations, web requests and tool calls against your policies before they execute. Depending on the host, policy and mode, it can allow, request approval or block an action, and records eligible authorization decisions with signed evidence. Fresh installs start in Profile mode, where written policy is advisory.
Native permissions already enforce rules outside the model. Isonapse adds a separate local policy engine shared across supported agents, repository policies you can version, and signed authorization records you can verify offline. It is useful when you want consistent controls across agent tools or need to inspect the policy behind a decision. Coverage still depends on each host's integration.
The public Agent Hook runs locally on your machine. Community Edition, currently in private beta for invited testers, provides a self-hosted team view of explicitly enrolled workloads. Isonapse does not require an Isonapse cloud service for local enforcement. Enterprise capabilities remain planned.
Agent Hook does not send your prompts, policies, learned state, decision records or usage telemetry to Isonapse. Installation, required and optional model downloads, and an opt-in update check contact external distribution services. You can explicitly share signed records with your own self-hosted CE server. Your AI agent or model provider may separately process data under its own settings.
The public beta supports Claude Code, exactly Hermes Agent v0.20.0, and exactly pi v1.0.3 and v1.0.4. Other Hermes and pi versions are not implied. Codex CLI can use the Hook ADK reference adapter, but its cooperative, fail-open behavior means it can run tools unchecked if the adapter cannot start or its hook definitions are not trusted. It does not provide the same assurance as the directly integrated hosts. Check compatibility before updating agent versions. Compare integrations →
In Enforce mode, your written policies and hard safety boundaries remain authoritative. A bounded, locally learned behavioural baseline can help distinguish familiar work from unusual activity, but it cannot override an explicit prohibition. Critical policy decisions do not depend on an LLM. Profile mode observes and advises; Normal enforces block rules but does not apply every Enforce check. Read about enforcement modes →
Isonapse checks the covered actions exposed by each supported host integration. Its guarantees depend on the host, active integration, hook trust configuration, mode and configured policies. The Hook is not an OS-level sandbox, and execution paths outside its integrations are not automatically governed. See technical details →
The local control plane signs every allow, and every question you can approve, that it issues into a tamper-evident chain you can verify offline. These records establish what was authorized under which policy; they are not blanket proof that an operation completed successfully. Certain local stops and daemon-unreachable prompts have documented receipt exceptions. Read the evidence guarantees →
Install the public Agent Hook using Homebrew, initialize the integration for your supported coding agent, start the local control plane and check its status. No Isonapse account is needed. Codex requires the separate reference-adapter setup. The quickstart provides platform requirements and exact integration commands. Open installation guide →
macOS on Apple silicon · Linux x86_64
Then follow setup for your host.
Agent Hook public beta · Community Edition private beta for invited testers · Enterprise coming Q1 2027