Grith

Claude Code ships the feature, then tries to POST .env to an outside host. grith denies it at the kernel boundary.

3.0 to 8.0 queue the process freezes until you approve or deny it

Nothing runs on a maybe. Eleven built-in profiles (claude-code, codex, aider, cursor, cline, copilot, goose and others) auto-allow each tool's routine work, so the queue only sees the calls worth your attention.

The installer auto-detects your platform, verifies the SHA-256 checksum, and installs to ~/.local/bin . Pass --global to install to /usr/local/bin , or --version <version> to pin a release:

You can also download a binary directly from the latest release , or build from source with Rust 1.88+ and Node 22+:

Every release ships a static musl binary with a SHA-256 checksum, a cosign keyless signature, a CycloneDX SBOM (itself signed), and SLSA build provenance. If cosign is on your PATH, the installer verifies the signature against the release workflow's identity automatically - no flags needed. To verify by hand, see release verification .

Found a security issue? Please follow SECURITY.md rather than opening a public issue.

Pro and Enterprise capabilities ship in the same binary and are unlocked by signed licenses. Hosted billing, license issuance, and cloud sync infrastructure are not part of this repository.