AI Guardian is a security layer for the AI agents running on your Mac. It watches what an agent is about to do — the tools it calls, the MCP servers it talks to, the skills it loads, the files it reaches for — checks each action against a policy you set during onboarding, and answers with a verdict: allowed, flagged, or blocked.
Everything is recorded in a local, encrypted audit log you can browse from the terminal, and anything that needs your eyes can also reach you as a private DM on the chat platform you choose.
More agents are planned.
Two pieces cooperate on your machine — nothing about a decision leaves it:
A small plugin installed into each protected agent (the OpenClaw gateway plugin, the Claude Code hook). It sees lifecycle events — a prompt being built, a tool about to run, a skill being installed — and forwards them for a decision.
A per-user background service that evaluates each event against your policy, writes the audit trail, watches credential paths, and sends alerts. The two talk over a local, user-private socket; the hook side is never trusted blindly.
Your window into both: onboarding, scans, reviews, status, the audit browser and allow rules all live in one terminal command.
AI Guardian ships with the Bitdefender agent for macOS during the BETA. Once installed, the aiguardian command is available from Terminal — start with the onboarding wizard:
OpenClaw
Claude Codeaiguardian onboard
Onboarding is a short wizard. It never changes anything silently: each step shows what it found, and your config stays as-is until you confirm.
The wizard introduces itself and states the beta terms — continuing means agreeing to the Terms of Service and Privacy Policy (t and p open each in your browser; Esc leaves with nothing installed). A second screen discloses that anonymous reporting of protection decisions is on for the beta.
Every supported agent detected on your Mac is listed with its version and config path. Ticked agents are set up one at a time.
Your installed skills are scanned locally. Clean skills pass; anything suspicious is flagged with the exact finding. Flagged skills default to block — flipping one to allow saves an exception scoped to exactly those findings, so anything new on the same skill still flags.
A default list of credential locations — SSH keys, cloud credentials, tokens — is blocked from agent access. Add your own paths or globs on top.
Each MCP server is verified before you decide. Verified servers default to allow; a server that fails verification — or won’t answer — defaults to remove. You can override either way, and a server that only needs sign-in can be authorized right there (a opens your browser) and re-verified on the spot.
Pick the chat platform where security alerts should reach you as a private 1:1 DM.
The wizard applies your policy (backing up the previous one), scans the agent’s config against it, and offers one-key fixes for what it can repair automatically.
Everything below is also in aiguardian --help (and every subcommand answers --help itself). Commands print a clean report in the terminal; the interactive ones open a full-screen browser you leave with Esc.
| Command | What it does |
|---|---|
aiguardian | Same as aiguardian scan — the default. |
aiguardian scan [agent] | Scan an agent’s config for issues and fix them. Without an agent it opens the picker. |
aiguardian onboard | Launch (or re-run) the onboarding wizard. |
aiguardian status | One-screen overview: protection, alerts and plan at a glance. |
aiguardian audit | Interactive audit-log browser. |
aiguardian allowlist | Browse the allow rules you have saved. |
aiguardian mcp status | Print every MCP server on this machine and the policy action on each. |
aiguardian mcp review [agent|all] | Re-review MCP servers and update each server’s keep/remove action. |
aiguardian mcp login <server> | One-time browser sign-in to an MCP server that requires authorization. |
aiguardian mcp logout <server> | Forget the stored authorization for an MCP server. |
aiguardian skills [agent|all] | Re-review the skills installed for a protected agent. |
aiguardian agents | Change which AI agents are protected. |
aiguardian credmon | Manage the credential paths blocked from AI access. |
aiguardian notifications | Reconfigure the alert platform and DM target. |
aiguardian hook reinstall <agent> | Force-reinstall the guardian hook for an agent — recovers a stale or disabled hook. |
aiguardian feedback | Send feedback to Bitdefender from a short in-terminal form. |
aiguardian about | Product version and third-party license information. |
AI Guardian uses a small, consistent vocabulary everywhere — the wizard, the audit log, and alerts:
The action was checked and allowed to proceed.
The action went through but was flagged for your review.
The action was stopped before it ran.
For MCP servers, policy stores one of two standing decisions per server:
allowremoveaiguardian audit opens a calendar of everything AI Guardian checked — encrypted, local, and grouped the way you'd investigate it.
An allow rule is a saved exception: “this tool, on these files, is fine.” Rules are written where you make the decision — press a on an audit event, or allow a flagged skill or MCP server during a review — and are as narrow as that moment: a tool name, an MCP server, a file path or glob, the exact findings you looked at.
Pressing a on an event opens the rule builder: a checklist of exactly what that event touched. Tick the parts the exception should cover with Space — the preview spells out in plain language what the rule would allow — edit a file path with e or widen it to a glob preset with g, then save with Enter. Nothing is saved until you do.
aiguardian allowlist shows every rule in plain language, with how often it matched and when it last fired, so stale exceptions are easy to spot and remove.
When something needs your eyes — a blocked tool call, a flagged skill — AI Guardian can DM you on the chat platform you picked during onboarding. Alerts go to a private 1:1 conversation, never a group.
Change the platform or the DM target at any time with aiguardian notifications. The audit browser shows the same attention items at the top of its calendar, so nothing depends on the DM arriving.
Decisions are made locally. Skill scans and policy checks run on your Mac, and the audit log is stored encrypted on your machine.
During the BETA, anonymous reporting is on for every install — onboarding states it up front (p on that screen opens the privacy policy) rather than asking, and the build ships without an off switch. It covers protection decisions only: how often a tool call was blocked or a skill was flagged, and which scanners fired. It never includes prompt contents, file contents, credentials, or anything your agents processed.
Questions the docs don’t answer yet are exactly what the BETA is for — send them straight from your terminal with aiguardian feedback.
This site is built to be read by AI assistants, browsers, and agents. Structured, curated context is available at: