Private preview · independent

Your AI agents talk to models all day. BARZEL judges every word.

A lightweight host policy agent for AI agents. It stands as an LLM door on your machine, classifies traffic, and denies what should not pass — fail-closed by design.

Get started See how it works

One door. Clear verdicts.

BARZEL sits on loopback as the LLM door for agent traffic. Every request is judged — classify or deny — and unclassified traffic never silently passes.

LLM door on loopback

Proxy binds to 127.0.0.1:8788. Agent LLM calls route through BARZEL before reaching upstreams such as openrouter.ai and api.anthropic.com.

Judge: classify / deny

A deterministic pre-filter plus an LLM judge scores prompts and completions for injection, exfiltration, and jailbreak patterns. Fail-closed — never pass through unclassified traffic.

Observe first

Default posture is observe. Host mutation stays off until you opt in. Mac Hermes pilot runs with BARZEL_ENFORCE=0 so you can see before you act.

Three named postures

Not every host needs the same risk. Watch, Guard, and Fortress make the tradeoff explicit — capability sets, not buried flags.

Watch

Default · zero mutation

  • Full LLM traffic classification
  • Live traffic and deny log
  • Zero host mutation capability
  • Safe on daily-driver machines

Guard

Single-host operators

  • Everything in Watch
  • Process quarantine (pause / resume) with revert
  • Protected-PID and allowlist safeguards
  • Dual-gate: policy + explicit env flag

Fortress

Hardened / disposable hosts

  • Everything in Guard
  • Network egress allow-listing
  • DNS sinkholing, NIC isolation

Linux-oriented today. Not for daily-driver machines — misconfiguration can lock you out of the host.

Controls you can see

Policy posture is visible, not magical. Enforcement is dual-gated so a tier change never silently turns mutation on.

Fail-closed doors

LLM, DNS, and egress doors fail closed. If the judge cannot classify, the request does not pass. Process and NIC stay fail-open unless Fortress-class controls are intentionally enabled.

Dual-gate enforce

Setting a tier alone does not activate host mutation. Enforcement requires both policy mode and an explicit env flag (for example BARZEL_ENFORCE=1). Pilot default remains BARZEL_ENFORCE=0.

Loopback console

A local console shows traffic volume, denies with reasons, and an audit trail of actions — one pane for operators, read from the host that runs the door.

Upstream awareness

Designed around real agent paths to openrouter.ai and api.anthropic.com. The door judges what agents send and receive on the host you control.

What BARZEL is not

Not a public cloud product

Private preview. Independent host policy agent. Install and access are invite or pack based — no public package registry install URL.

Not an enterprise SOC replacement

Single-host posture for AI agent traffic and optional host actions. Not a fleet SIEM, not a cloud CNAPP.

Not enforce-by-default

Observe first. Fortress-class network controls are for hardened or disposable Linux hosts — documented caveats, not silent upsell.

Private access

BARZEL ships Watch-first. Source lives in a private repo. No public install URL, no API keys on this page.

Request access

Private preview for design partners and operators running AI agents on a host you control.

Request early access

Operator facts

  • LLM door: 127.0.0.1:8788
  • Health: 127.0.0.1:8791
  • Pilot: observe · BARZEL_ENFORCE=0
  • Upstreams: openrouter.ai · api.anthropic.com
  • Repo: private · github.com/f-o-x11/barzel
# Mac Hermes pilot posture (illustrative)
# BARZEL_ENFORCE=0   observe, no host mutation
# door listens on     127.0.0.1:8788
# judge               classify / deny · fail-closed