Your AI agents have production keys. We make sure they can't use them wrong.
GeraGuard is an independent security control layer for AI agents. It identifies agents, limits which data and systems they can reach, stops dangerous actions before execution, and proves what happened — so your developers can ship with agents without handing them the kingdom.
Built for software companies running coding agents · macOS + Linux first · GitHub + one cloud
An agent running as your employee inherits everything your employee can touch.
Source code, browser sessions, SSH keys, cloud credentials, internal APIs — a coding agent operates with its user's full authority. An ambiguous request, a poisoned repository file, or excessive permission turns a legitimate command into an unsafe action. Detecting a process named after an AI product is not security.
Indirect prompt injection
A document, PR comment, or tool response the agent reads can steer it to export secrets or run destructive commands — without the attacker touching your network.
Excess authority
The agent that fixes a CSS bug has the same production database credentials as the deploy pipeline. One misunderstood instruction deletes records.
Compromised tools
An approved MCP tool updates overnight and changes behaviour. The tool description you approved is not the executable you're running.
Five questions. Answered continuously, with evidence.
The important security relationship is between authority and action. GeraGuard is built around answering these five questions for every agent session.
Which agents exist?
Discover supported agents across developer devices, CI runners, and cloud workloads. Label unknown coverage honestly instead of pretending everything is seen.
Whose authority do they use?
Bind every session to a human owner, device identity, agent version, and task scope. A PID and a process name are not an identity.
Which resources can they reach?
Map accessible files, credentials, tools, repositories, and production systems per session — before anything goes wrong.
Is the next action permitted?
Evaluate deterministic policy before supported tool, deployment, and API operations. Explicit deny wins; missing identity never becomes an allow.
What happened afterward?
Correlate sessions to operations, commits, and deployments. Produce an evidence record showing the authority used, the control applied, and the exact operation allowed or denied.
Enforcement at the point of action, not after the fact.
The model may propose an action, but it never supplies trusted identity, data labels, or approval status. Privileged execution is mediated by components the agent cannot modify.
Authenticate
Employee, device, and workload identity established.
Scope session
Task-bound identity with policy version attached.
Evaluate policy
Deterministic allow / deny / require-approval decision.
Execute controlled
Action runs through the gateway or brokered adapter.
Record evidence
Session, operation, and outcome linked for audit.
Endpoint connector
Inventory, session launch, and policy distribution. Small signed service with OS-specific adapters.
Isolated execution
Constrained files, network, and subprocesses. The enforceable boundary lives here, not in the prompt.
Tool gateway
Canonicalises requests, enforces tool policy, inspects results. MCP and HTTP API adapters.
Credential broker
Binds identity and approval to downstream permissions. No raw secrets in agent environments.
Policy engine
Deterministic allow / deny / require-approval. Signed, versioned bundles. AI classifies; logic decides.
Evidence service
Correlates sessions, operations, commits, and deployments into an auditable record.
Sensible defaults. Explicit enforcement points.
Hard restrictions evaluate first, then approval requirements, then allow rules. An explicit deny always wins — and missing identity never silently becomes an allow.
| Policy | Enforcement location | Decision |
|---|---|---|
Protect private keys & production secrets Agent cannot read raw protected credentials. Secrets are brokered, never pasted into prompts. | Isolated filesystem + credential broker | DENY |
Restrict external transfers Data leaves only to approved destinations and approved accounts. Transformed or chunked leaks are tested, not assumed safe. | Controlled egress + tool gateway | DENY |
Restrict tools & MCP servers Only approved tool versions and validated argument schemas. Changes re-evaluated; version pins enforced. | Tool / MCP gateway | DENY |
Require production approval Writes to production need a scoped human approval bound to session, operation, arguments, and expiry. | Credential broker + production adapter | APPROVAL |
Protect critical repositories IAM, CI, authentication, and destructive migration changes require review and protected checks. | GitHub rules + required checks | APPROVAL |
Stop runaway activity Shared session budgets cap cost, calls, writes, and concurrent child tasks across delegation. | Session budgets + gateway quotas | DENY |
Repository read in workspace Ordinary reads inside the assigned workspace proceed without friction. | Local policy | ALLOW |
Three assurance levels. Per resource, not one green score.
A control-plane view that hides bypass routes is marketing. GeraGuard labels what each control actually achieves.
🔵 Observed
An action was recorded with session identity and resource reference. Useful for inventory and investigation; not prevention.
🟡 Evaluated
Policy was checked before a supported action — but bypass routes may exist for this resource. Shown explicitly.
🟢 Enforced
The protected operation cannot use the intended authority without passing through the control, under stated assumptions.
Priced per protected developer, not per scare.
Pilot first: $5k–$15k for a 4–6 week paid pilot, credited against the first annual contract.
- One supported workflow
- Standard policy library
- GitHub integration
- 30-day evidence retention
- Community support
- Tool governance + MCP registry
- GitHub + one production integration
- Credential broker + scoped approvals
- 90-day incident evidence
- SSO + role-based access
- Dedicated onboarding
- Delegated administration
- Multiple environments + residency
- Custom integrations
- Pen-test + assurance package
- SLA + named support engineer
We're looking for three design partners.
50+ developers, managed devices, GitHub, an identity provider, and a cloud platform. You get a working prototype on one workflow, measured coverage, and a documented buy-or-stop decision. We get the truth about whether this is worth building.