Belay: a local firewall for AI coding agents
Belay is an open-source, local-first security layer that gates AI coding agent tool calls, blocking secret leaks and destructive commands in real time.
Belay is an open-source, local-first security layer that gates every tool call made by AI coding agents, aiming to stop damage from prompt injection, hallucinated destructive commands, or malicious MCP tool responses — all decided in under 100ms with no LLM in the loop and no cloud round-trip.
The tool auto-detects 11 different agents including Claude Code, Codex, Cursor, and Hermes, instrumenting each via its native mechanism (hooks, config policy, or MCP proxy) rather than a generic shim. It blocks secret exfiltration, destructive commands like rm -rf, reverse shells, supply-chain attacks, and injection markers embedded in MCP tool responses, while escalating ambiguous cases to a one-tap Allow/Deny via terminal, desktop app, or phone.
Detection is pattern-based rather than a full sandbox, so Belay is positioned as defense-in-depth rather than a guarantee. It's AGPL-3.0 licensed, self-hostable, and emits SARIF output for CI security scanning pipelines, giving engineers an inspectable alternative to trusting an agent with unchecked shell access.
This synthesis was produced from its source by AI; there is no human editor or manual review step. How we work