79 policies. 380 rules. Zero config.
Two commands. 79 policies.
Your agents governed before they execute.
Open source policy enforcement for AI agents. Developer first. Enterprise ready.
Deterministic. Local. Under 10 ms.
Works with Claude Code, Cursor, GitHub Copilot and Gemini CLI.
Browse all 79 policiesApache 2.0. No telemetry. No account required.
Works with your tools
vectimus init detects installed tools and configures hooks automatically. Agent frameworks get native Python integrations.
AI Coding Tools
Claude Code
Shell commands, file writes, MCP calls and web fetches — all intercepted before execution.
Full supportCursor
Shell commands, file reads and writes, and MCP tool calls governed at the editor level.
Full supportGitHub Copilot
Terminal commands, file edits, deletes and git pushes intercepted before execution.
Full supportGemini CLI
Shell commands, file reads and writes governed through Gemini's native hook system.
Full supportCodex CLI
Bash shell commands intercepted via PreToolUse hooks. File and MCP coverage limited by Codex upstream.
ExperimentalAgent Frameworks
Claude Agent SDK
Agents built with the Claude Agent SDK are governed through the same hook system as Claude Code. Zero extra config.
Full supportGoogle ADK
Runner plugin or per-agent callback governs every tool call in Google Agent Development Kit agents.
Full supportLangGraph
Middleware wraps ToolNode to evaluate every LangChain tool call. MCP interceptor governs external servers.
Full supportTwo commands. Immediate guardrails.
79 policies active out of the box. Disable or override per project when you need to.
Governance you can't inspect isn't governance
Vectimus is open source because security tooling should be auditable by the people who rely on it.
Readable and auditable
Every policy is a plain Cedar file you can read, fork and modify. Every evaluation produces a cryptographically signed receipt you can verify offline. No proprietary rule engines, no black boxes.
No vendor lock-in
Apache 2.0 licensed. Use it, extend it, contribute back; or don't. Your governance layer belongs to you.
Everything stays local
All evaluation happens on your machine. No telemetry, no cloud calls, nothing leaves your environment.
Show your CISO the source
When your security team asks how agent governance works, show them the Cedar policies line by line. Hand them the signed receipts as proof it ran.
This is already happening
AI agents with unrestricted tool access have caused real damage. These incidents motivated every policy in the base pack.
Clinejection
February 2026 | 4,000+ developers compromised
A malicious MCP server instructed AI coding agents to publish backdoored npm packages. No governance layer existed between the agent's intent and npm publish.
Terraform destroy
January 2026 | 6-hour production outage
An AI agent ran terraform destroy -auto-approve against production state. The command completed in 30 seconds, destroying databases and compute instances.
Cursor .env leak
November 2025 | AWS credentials exposed
An AI agent in Cursor read .env to 'check the config' and included AWS keys in its response context. The keys were visible in the conversation history and potentially sent to third-party logging.
drizzle-kit push
February 2026 | 60+ production tables dropped
An AI agent ran drizzle-kit push against a production database on Railway. The ORM bypassed interactive confirmation, dropping 60+ tables in seconds.
When permissions get skipped. Vectimus doesn't.
Claude Code's --dangerously-skip-permissions,
Cursor's yolo mode, Copilot's auto-run. Confirmation prompts get turned off.
When the agent's built-in checks are removed, nothing sits between the model and your shell.
Vectimus does.
Every tool call still passes through 79 deterministic Cedar policies containing 380 rules, whether the agent asked for your permission or not. Credential access, destructive commands, MCP exfiltration patterns and dangerous content hidden in scripts. All caught at the hook layer before execution.
You get the speed of unrestricted mode. You lose the risk of an unmonitored agent running rm -rf /,
leaking .env files or pushing to production without you noticing.
Skip permissions. Not governance.
The agent's permission model is one layer of defence. Vectimus is another.
When the first layer is removed, the second still holds. Hooks fire on every tool call regardless of what mode the agent runs in.
Permissions get skipped.
Whether by choice, by configuration, or by a team that needs to move fast. Vectimus is the layer that's still evaluating every tool call when that happens.
Full audit trail, even in yolo mode.
Every evaluated action is logged with the tool call, the policy result and a timestamp. When something goes wrong you can trace exactly what happened.
What you get
A safety net between the agent and the shell. Deterministic. Auditable. Yours.
Try before you enforce
Observe mode logs what would be blocked without stopping anything. Review the audit log, tune your policies, then flip the switch when you are ready.
Under 10ms. Every time.
Evaluates 79 Cedar policies in under 10ms end-to-end via the persistent daemon. ~3ms Cedar evaluation plus socket overhead. Or point clients at a shared server for team-wide policies.
Lock down MCP servers
Every MCP tool call is blocked by default. Approve servers one by one. Input inspection catches credential leaks and CI/CD tampering on approved servers.
Sees inside scripts too
When an agent writes a file or runs a script, Vectimus inspects the content line by line. Your shell policies catch dangerous commands whether they are typed directly or hidden in a script.
Override per project
Disable or change enforcement per project in .vectimus/config.toml. The directory is policy-protected so agents cannot tamper with overrides.
Nothing leaves your machine
Zero telemetry. All evaluation happens locally. Audit logs stay on disk. The optional server is self-hosted on your infrastructure.
Signed proof for every decision
Every evaluation produces a cryptographically signed receipt. Ed25519 signature over canonical JSON. If anyone tampers with the receipt, the signature breaks. No trust required.
- Trace every deny. Every deny message includes a receipt ID. Look up exactly which policy fired and why.
- Verify offline.
vectimus verify receipt.jsonchecks the Ed25519 signature without network access. - Tamper-evident. The signature covers the entire receipt including the policy set hash. Change one byte and verification fails.
- Auto-managed. 7-day retention by default. The daemon cleans up old receipts automatically.
{
"receipt_id": "vtms-bf387670-6abb-...",
"timestamp": "2026-03-22T14:30:26Z",
"action": {
"tool": "Bash",
"normalised_tool": "shell_command",
"command_summary": "terraform destroy -auto-approve",
"context_hash": "sha256:3d53dd78..."
},
"policy": {
"policy_set_hash": "sha256:44c5a662...",
"policy_pack_version": "0.2.0"
},
"decision": {
"outcome": "DENY",
"reason": "vectimus-infra-001",
"evaluation_time_ms": 2.0
},
"signature": {
"algorithm": "Ed25519",
"public_key_id": "vtms-key-73ae52",
"value": "base64:79rhTFMGNGi3fY..."
}
}Policies backed by real incidents
Every built-in rule references the incident that made it necessary.
10 of 10 OWASP Agentic categories. Covered.
Policies across all domain packs map to the OWASP Top 10 for Agentic Applications.
Active rules
Exfiltration patterns intercepted
Destructive commands blocked
Credential access detected
Lockfile and registry tampering blocked
Reverse shells and eval patterns caught
Agent config file writes blocked
Parameter checks locally; session tracking in server mode
Spawn floods and action rate spikes detected in server mode
Privilege delegation and dangerous spawn patterns blocked
Log tampering and persistence blocked
Your team is already using it. Now make it official.
Already running Vectimus locally? Server mode gives your security team the same policies, centralised.
- Team-wide policy enforcement — same Cedar policies, centrally managed
- Shared audit logs with session tracking
- API key auth with OAuth/OIDC planned
Join the waitlist to shape what comes next.
Compliance evidence built in
Every rule maps to real compliance controls via @controls annotations.
When audit time comes, the evidence is already there.
OWASP Agentic Top 10
10 of 10All 10 categories enforced across 11 policy packs
SOC 2
6 criteriaLogical access, boundary protection, change management
NIST AI RMF
3 functionsBehaviour monitoring, risk mitigation, third-party risk
NIST CSF 2.0
8 subcategoriesData security, platform security, continuous monitoring
EU AI Act
5 articlesRecord-keeping, transparency, human oversight, cybersecurity
ISO 27001
8 controlsOrganisational and technology controls for information security
Vectimus is the enforcement and audit layer for AI agent actions. It does not replace a full compliance programme. Each mapping is transparent about what is and is not covered.
How it works
Every tool call passes through Vectimus before execution. Run locally for zero-setup individual use, or point your clients at a shared server for team-wide policy enforcement.
- Works with coding agents and Python agent frameworks
- Persistent daemon. No network. Under 10ms.
- Ed25519-signed receipt for every evaluation
- Governs developers and AI applications from a single server
- Stateful session tracking detects spawn floods and rate spikes
- Signed receipts and shared audit log across the whole team
Start governing your AI agents today
Two commands. Under a minute. No account required.