Grenz — Firewall for AI Agents
AI agents today borrow their human's credentials wholesale: a coding agent gets your entire GitHub token, your production database URL, your Slack workspace. One poisoned input and the agent is the attacker, holding everything you hold. Grenz is a local proxy that sits between the agent and every upstream service it touches, and answers 'may this agent do X, to this target, right now?' before the call leaves the machine. The agent carries a GRENZ_TOKEN — a scoped badge, not your master key: real credentials live inside the proxy and are injected only on the outbound request, so they never reach the agent, the transcript, or the logs. Policies are YAML, compiled to a deterministic decision path of 23 ordered gates — grant, target scope, budget, schedule, content scan, approval — evaluated locally with no network hop and no third party on the decision path. Risky actions block for a human with a TTL that expires to DENY, and a kill switch revokes mid-task. Shadow mode and policy replay let you see exactly what a policy would have stopped before you enforce it. Everything unmatched, malformed, or failing resolves to deny-by-default with a structured reason code.
Products I own and operate end to end — my roadmap, my users, my on-call.
- ▸Agents need real credentials to be useful, but handing over a full-scope token makes every agent mistake — or every prompt injection — a potential incident
- ▸Permission checks must add near-zero latency: a network hop on every tool call would make the proxy unusable, and a third-party decision path is its own risk
- ▸Approval flows have to interrupt the agent without killing it: block, ask a human, resume or deny
- ▸Credential material must be provably absent from every log line, error message, and payload
- ▸Nobody enforces a policy they haven't seen the blast radius of — a policy has to be observable before it is enforced
- ▸Single binary with no runtime deps: the agent talks to Grenz with a GRENZ_TOKEN, Grenz injects real credentials on the outbound request — they never flow back toward the agent
- ▸Policy engine embedded in the proxy: YAML compiled to a fixed 23-gate decision path (grant, target scope, budget, schedule, content scan, approval), evaluated locally with table-driven tests for every allow/deny/approval path
- ▸Per-action, per-target grants — reading a repo and deleting one are separate decisions, and each narrows to named repos or channels
- ▸Approval gates block and push to Slack/CLI with a TTL that expires to DENY, plus a kill switch that revokes a running agent mid-task
- ▸Shadow mode, policy replay, and hot reload: simulate a policy against real traffic before enforcing it
- ▸Credential vault behind a CredentialStore interface (age-encrypted file, HashiCorp Vault) so new backends slot in without touching call sites
- ▸Fleet deployment with signed policy distribution, OIDC SSO, and Prometheus metrics for teams running more than one agent
Shipped and MIT licensed at grenz.dev — single binary or Docker, source public on GitHub
1,239 tests over the decision path, with deny-by-default verified for unmatched requests, malformed policies, and vault failures
Adapters for GitHub (REST), Linear and Slack (MCP), and any MCP server, so one policy language covers every tool an agent reaches for
Zero real credentials ever exposed to the agent — enforced by grep-checked log and error paths in CI
JobJam.io — AI Job Search & Application Platform
AI-powered job search platform: discover roles, evaluate fit, tailor applications, and close skill gaps. One-time pricing, no subscriptions.
Fathohm — Comprehension-Debt System of Record
See how much of your codebase no human understands. A treemap of your repo colored by human comprehension score, with a tracked, assignable metric for 'who understands what' in an AI-native codebase.
AI Workflow Builder
Chain LLM steps into a workflow with {{stepId.output}} substitution between steps. Pick a preset, edit any prompt, watch the chain execute step by step.