Private preview · independent

Host policy that acts — not a monitor that only watches.

BARZEL is an independent host-policy agent for AI agents. It judges LLM traffic on loopback, then — when dual-gated — quarantines processes, sinkholes DNS, and denies egress. Watch → Guard → Fortress.

Get started See how it works

Watch → Guard → Fortress

BARZEL sits on loopback as the LLM door, then escalates from seeing to acting. Dual-gate (policy mode=enforce + BARZEL_ENFORCE=1) must open before any host mutation.

Watch — see

LLM door on 127.0.0.1:8788. Classify / deny traffic to openrouter.ai and api.anthropic.com. Fail-closed. Sensors + audit. Zero host mutation — the safe default install.

Guard — act

Everything in Watch, plus process quarantine (SIGSTOP / resume with revert). Protected-PID and allowlist safeguards. Requires dual-gate — a tier swap alone never mutates.

Fortress — harden

Everything in Guard, plus egress deny, DNS sinkhole, and optional NIC isolation. Linux / disposable hosts. Misconfiguration can lock you out — dual-gate + revert required.

Three named postures that act

Capability sets, not buried flags. Observe-first is the safe default install — not the product ceiling. Guard and Fortress mutate the host when dual-gated.

Watch

See · zero mutation

  • Full LLM traffic classification
  • Live traffic and deny log
  • Zero host mutation capability
  • Safe default install / daily-driver

Guard

Act on the host

  • Everything in Watch
  • Quarantine processes (pause / resume) with revert
  • Protected-PID and allowlist safeguards
  • Dual-gate required before any ACT

Fortress

Act on the network

  • Everything in Guard
  • Egress deny (TEST-NET cidrs, not 0.0.0.0/0)
  • DNS sinkhole + optional NIC isolation

Linux / disposable hosts. Not for daily-drivers — Fortress misconfiguration can lock you out. Dual-gate + documented revert required.

Controls you can see

Policy posture is visible, not magical. Enforcement is dual-gated so a tier change never silently turns mutation on.

Fail-closed doors

LLM, DNS, and egress doors fail closed. If the judge cannot classify, the request does not pass. Process and NIC stay fail-open unless Fortress-class controls are intentionally enabled.

Dual-gate enforce

Setting a tier alone does not activate host mutation. Enforcement requires both policy mode and an explicit env flag (for example BARZEL_ENFORCE=1). Pilot default remains BARZEL_ENFORCE=0.

Loopback console

A local console shows traffic volume, denies with reasons, and an audit trail of actions — one pane for operators, read from the host that runs the door.

Upstream awareness

Designed around real agent paths to openrouter.ai and api.anthropic.com. The door judges what agents send and receive on the host you control.

What BARZEL is not

Not a public cloud product

Private preview. Independent host policy agent. Install and access are invite or pack based — no public package registry install URL.

Not an enterprise SOC replacement

Single-host posture for AI agent traffic and optional host actions. Not a fleet SIEM, not a cloud CNAPP.

Not mute forever

Observe-first is the safe default install, not a permanent ceiling. Guard/Fortress act when dual-gated. Fortress stays for hardened or disposable Linux hosts — documented caveats, not silent upsell.

Private access

Early access installs Watch-first (safe default). The product ceiling is Guard/Fortress ACT under dual-gate — not forever-monitor. Private repo; no public install URL.

Request access

Private preview for operators who need a host-policy agent that can act on AI agent traffic — after you open the dual-gate.

Request early access

Operator facts

  • LLM door: 127.0.0.1:8788
  • Health: 127.0.0.1:8791
  • Default install: observe · BARZEL_ENFORCE=0
  • ACT: dual-gate · policy enforce + BARZEL_ENFORCE=1
  • Upstreams: openrouter.ai · api.anthropic.com
  • Repo: private · github.com/f-o-x11/barzel
# Safe default install (illustrative)
# BARZEL_ENFORCE=0          Watch — see, no host mutation
# door                      127.0.0.1:8788 · fail-closed
#
# Dual-gate ACT (controlled / disposable hosts)
# policy mode=enforce  AND  BARZEL_ENFORCE=1
# Guard: quarantine --apply / --revert
# Fortress: dns sinkhole / egress deny — then revert