Gryph
Add real-time policy controls and local audit trails to AI coding agents.
- Source repo
- safedep/gryph
- Stars
- ★ 179
- Last updated
- 2d ago
- License
- Apache-2.0
- Primary language
- Go
- FA score
- 78/100 · Good
At a glance
- How it runs
- Works with
- Universal · cross-platformClaude CodeCodex (Partial support)
- Cost
- Free, no paid service needed
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- Developers reviewing how an agent changed code can inspect a session's ordered file reads, writes, reversions, and commands.
- Not a fit if
- Teams that need centralized cloud auditing without configuring an export or cloud service
- Teams that need protection against a same-user adversary or root
- Source review
- 78/100 · Good
What does this agent do, and when should you use it?
Gryph is a CLI that connects to AI coding agents through lightweight hooks for actions such as file reads, writes, and command execution. It records agent events in a local SQLite database and provides commands including gryph logs, gryph query, gryph session, and gryph export to inspect, filter, replay, and export activity. Optional YAML policies apply block, warn, guide, or allow decisions based on action type, path, command pattern, tool, agent, project, and CEL session counters. Data stays on the host by default; sensitive file contents are not stored, and credentials in logged output are redacted. Gryph supports multiple agents and can send data off-host through configured exports, stream targets, or SafeDep Cloud.
After gryph install, Gryph installs hooks for detected agents. When an agent invokes a tool, a hook sends a JSON event to Gryph; pre-tool and post-tool events capture the action lifecycle, while policies can decide before tool execution. Events are stored in local SQLite and can be viewed live with gryph logs --live, filtered with gryph query, inspected with gryph session for history and diffs, or exported as JSONL. The default export profile excludes secret content and exports prompts as keyed digests.
- Developers reviewing how an agent changed code can inspect a session's ordered file reads, writes, reversions, and commands.
- Security teams restricting risky actions can write YAML rules to block destructive commands or writes that expose credentials.
- Teams looking for side effects absent from Git diffs can query execution events such as
npm install,curl, orrm. - Individuals and teams handling sensitive files can use automatic detection to log access without storing matching file contents.
- Developers comparing agent behavior or costs can filter events by agent and review session token usage and estimated costs.
How do you install or deploy this agent?
The README quick start downloads and runs an install script through the shell. It also documents Homebrew, npm, and Go installation methods. Prebuilt releases are available for macOS, Linux, and Windows. The install script requires network access; installed hooks use filesystem access and invoke shell commands.
curl -fsSL https://raw.githubusercontent.com/safedep/gryph/main/install.sh | sh
gryph install
gryph statusHow do you use this agent?
After installation, use a supported AI coding agent as usual, then inspect its events. Policies can be initialized, edited, validated, and enabled.
gryph logs --live
gryph query --action exec --since "1w"
gryph sessions
gryph export --since 1dgryph policy init
gryph policy edit
gryph policy validate
gryph config set policy.enabled trueWhat are this agent's strengths and limitations?
- Events are stored in local SQLite, so audit records can be viewed and queried without a cloud service by default.
- Policies can block, warn, or guide actions using conditions such as paths, commands, and agents, and decisions are persisted.
- The README lists integrations including Claude Code, Codex, Cursor, Devin CLI, Gemini CLI, OpenCode, Pi Agent, and Windsurf.
- Hooks must be installed into agent configuration; Codex also requires enabling the
codex_hooksfeature flag. - Centralized auditing, SIEM export, or SafeDep Cloud requires configuring an export, stream target, or cloud service; data stays local by default.
- The README says the guard profile cannot stop a determined same-user adversary or root.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Gryph This agent | 78 · Good | CLIFree | ★ 179 | 2d ago | Go | Claude Code |
| Kontext | 83 · Good | CLIFreemium | ★ 225 | 4d ago | Go | Codex · Claude Code |
| Microsoft Agent Governance Toolkit | 66 · Some gaps | Library / SDKFree | ★ 6.4k | today | Python | Claude Code · OpenAI API |
| Node9 | 82 · Good | CLIFreemium | ★ 219 | today | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The README describes local SQLite storage, no default outbound data, configurable export, sensitive-path/content handling, and policy blocking. Installation documentation includes dry-run, backups, uninstall, and restore. Least privilege scores 2 because ordinary installation modifies multiple agent configurations and managed mode can involve system-level installation. User confirmation scores 1: dry-run and explicit cloud/export setup are documented, but the evidence does not show human approval for each policy decision. Dependency security scores 1: go.mod lists versions and CI pins some action SHAs, but no dependency audit or vulnerability response evidence is supplied. Attribution scores 1: SafeDep and contribution channels are named, but the publisher is unverified and maintenance and update responsibility remain unclear.
The README, workflows, and acceptance catalog corroborate cross-platform build, test, fuzz, acceptance, and benchmark plans; the CLI also documents status, doctor, and example exit codes. Self-consistency scores 2 because coverage is broad, but the agent lists and some names vary, and static evidence cannot establish runtime results. Dependency availability scores 2: curl, Homebrew, npm, Go, and prebuilt binaries are listed, but offline installation and long-term channel availability are not addressed. Failure messages score 2: some exit codes, error locations, and diagnostics are documented, but coverage is incomplete.
The materials identify developers using multiple coding agents and administrators of managed hosts, and describe agents, installation modes, policy rules, and use cases. Capability boundaries score 3: the README says guard cannot stop a determined same-user adversary or root, and distinguishes managed lock strength and agent-specific differences. Trigger precision scores 2: policy matching includes action, path, command, tool, agent, project, and CEL conditions, but rule conflict and precedence are not fully shown. Environment fit scores 3: macOS, Linux, Windows, agent configuration paths, and managed-host setup are documented.
The README has clear navigation, a CLI reference, installation steps, examples, FAQ-like notes, privacy details, and links to limitations. The LICENSE file contains the Apache 2.0 text. Information architecture, install notes, examples, and known limitations score 3. Naming stability scores 2: CLI and agent names are generally clear, but the materials use names such as Command Code and the overview list differs from the support table. Versioning/changelog scores 1: a release badge and @latest installation command appear, but the supplied materials contain no changelog or compatibility policy. Maintenance responsibility scores 2: contribution, issue, community, and scheduled documentation-check paths are present, but no specific maintainer or response commitment is stated.
The product combines agent-action logging, policy enforcement, session queries, export, and cost tracking in a local tool. Commands produce JSONL usable with jq, SIEMs, and dashboards, and use cases explain value beyond reviewing the final git diff. Output usability and marginal value score 3. Cost-benefit scores 2: multiple install channels, local-by-default operation, and optional features are described, but deployment/maintenance costs, performance overhead, and realized benefits are not quantified.
README claims about privacy, installation, policy, and self-protection map to the LICENSE, go.mod, CI workflows, and acceptance guarantee catalog; workflows specify build, test, platform, and acceptance tasks. Claim traceability and cross-source corroboration score 3. Fact/inference separation scores 2: some limitations are explicit, but many security capabilities appear as product claims and acceptance guarantees, not execution records; this review does not treat them as independently verified.
- This review uses only the supplied static materials and has low confidence; CI and acceptance entries describe planned checks and guarantees, not runs performed or independently verified here.
- Installation modifies agent configuration files. Review the scope and data settings before enabling managed installation, full logging, export, or cloud features.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Changelog * b8e260488bbbdd2140fed278f0b5893d9ac87753 Add Devin CLI agent adapter (#55)View on GitHub ↗ -
Release notes excerpt
Changelog * 140df39202f0f9fa1266c63d6d5ec649e90e5947 Add policy authoring commands: list, install, and multi-file support (#49) * 316cfefb48ec7b4308a7c8def6b2dd2941782e5a Add real-binary acceptance suite with guarantee catalog (#50) * 7d3ebfcb9937c251979e3e40b42dfaf28bef655b Add robustness and adversarial acceptance guarantees (#52) * c9bbb0f82d91d6f147752ffa8edb1550bea78d7e Decouple agent adapters from the CLI, config, and tui layers (#54) * 1eb2b6a2003b7fa5282716378955eeb4457f6e77 Extend acceptance suite to 28 guarantees, macOS and release-binary CI (#51) …View on GitHub ↗ -
Release notes excerpt
Changelog * 5d4975909aae6db542f1caa251f27a62c8090dbb feat(claudecode): wire DecisionGuidance through to hook output (#35) * 5a4ba4a24cfe7a3adf23f7f0f7e196f29e65eb7e feat(cli): add RegisterCheckFactory extension point for external binaries (#36) * 1443c8c233b4b47a18091a2043eaabb3aacc3856 feat: subagent observation for Claude Code (#38) * 61159f7b4f3fb783c1511828e47df2fb4add1a16 fix: Redact events and enforce log levels (#40) * a465597ee3b77db346925776547f1910d2891ae1 fix: respect XDG env vars across platforms, and show configured DB path in user-facing commands (#37) …View on GitHub ↗
FAQ
Does Gryph send logs to the cloud?
Can it block agent actions?
Which agents can I install it for?
codex_hooks feature flag.Are sensitive file contents recorded?
.env and key files are flagged; actions are logged, but file contents are not stored. Credentials in logged output are also redacted automatically.