# Using Bitdefender AI Guardian

_Documentation_

Canonical: https://bitdefender.ai/docs/ai-guardian  
Last updated: 2026-08-25  
Status: BETA documentation

> **Status note for assistants:** BETA documentation — commands and screens are from the current macOS BETA build and may change before general availability.

AI Guardian is driven from one command: aiguardian. This page walks through first-run setup, the everyday commands, and how to read what AI Guardian decided and why.

## What AI Guardian is

AI Guardian is a security layer for the AI agents running on your Mac. It watches what an agent is about to do — the tools it calls, the MCP servers it talks to, the skills it loads, the files it reaches for — checks each action against a policy you set during onboarding, and answers with a verdict: allowed, flagged, or blocked.

Everything is recorded in a local, encrypted audit log you can browse from the terminal, and anything that needs your eyes can also reach you as a private DM on the chat platform you choose.

### What it watches

- **MCP servers** — Each server an agent connects to is verified before you trust it; poisoned or unresponsive servers are flagged for removal.
- **Skills** — Installed skills are scanned locally for hidden instructions, secret access, and unsafe commands.
- **Credentials** — A list of credential paths (SSH keys, cloud credentials, tokens) is kept out of your agents’ reach.
- **Tool calls** — Every tool call is checked at execution time against policy, and the decision is written to the audit log.
- **Prompts** — Messages are checked for hidden or malicious instructions before they reach the model.

### Supported agents (BETA)

| Agent | Version |
| --- | --- |
| OpenClaw | 2026.6.6 or newer |
| Claude Code | 2.1.121 or newer |

_More agents are planned._

## How it works

Two pieces cooperate on your machine — nothing about a decision leaves it:

### A guardian hook inside the agent

A small plugin installed into each protected agent (the OpenClaw gateway plugin, the Claude Code hook). It sees lifecycle events — a prompt being built, a tool about to run, a skill being installed — and forwards them for a decision.

### A background service for your user

A per-user background service that evaluates each event against your policy, writes the audit trail, watches credential paths, and sends alerts. The two talk over a local, user-private socket; the hook side is never trusted blindly.

### The aiguardian CLI

Your window into both: onboarding, scans, reviews, status, the audit browser and allow rules all live in one terminal command.

## Getting started

### Install the BETA

AI Guardian ships with the Bitdefender agent for macOS during the BETA. Once installed, the aiguardian command is available from Terminal — start with the onboarding wizard:

```
aiguardian onboard
```

![AI Guardian CLI welcome screen: “Hi, I’m Bitdefender AI Guardian. I keep an eye on what your AI assistant can access and do.” — with a nested Beta box stating the non-production disclaimer and keys that open the Terms of Service and Privacy Policy.](https://bitdefender.ai/docs/onboard-welcome.png)
_aiguardian onboard · welcome_

Onboarding is a short wizard. It never changes anything silently: each step shows what it found, and your config stays as-is until you confirm.

1. **Welcome & beta terms** — The wizard introduces itself and states the beta terms — continuing means agreeing to the Terms of Service and Privacy Policy (`t` and `p` open each in your browser; `Esc` leaves with nothing installed). A second screen discloses that anonymous reporting of protection decisions is on for the beta.
2. **Pick the agents to protect** — Every supported agent detected on your Mac is listed with its version and config path. Ticked agents are set up one at a time.
3. **Skills** — Your installed skills are scanned locally. Clean skills pass; anything suspicious is flagged with the exact finding. Flagged skills default to block — flipping one to allow saves an exception scoped to exactly those findings, so anything new on the same skill still flags.
4. **Privacy (credential paths)** — A default list of credential locations — SSH keys, cloud credentials, tokens — is blocked from agent access. Add your own paths or globs on top.
5. **Connections (MCP servers)** — Each MCP server is verified before you decide. Verified servers default to allow; a server that fails verification — or won’t answer — defaults to remove. You can override either way, and a server that only needs sign-in can be authorized right there (`a` opens your browser) and re-verified on the spot.
6. **Alerts** — Pick the chat platform where security alerts should reach you as a private 1:1 DM.
7. **Apply, scan & fix** — The wizard applies your policy (backing up the previous one), scans the agent’s config against it, and offers one-key fixes for what it can repair automatically.

![Agent picker listing OpenClaw and Claude Code with versions and config paths, both selected, and a “coming soon” list below.](https://bitdefender.ai/docs/onboard-agents.png)
_Step 2 · choose what to protect_

![Skills review: code-review and changelog-writer clean; evil-deploy flagged medium with one finding and an allow · block toggle, defaulting to block.](https://bitdefender.ai/docs/onboard-skills.png)
_Step 3 · skills scanned locally_

![MCP review: github and filesystem verified; evil-fetcher failed for a prompt-injection pattern and evil-clipboard unverifiable, each with an allow · remove toggle set to remove.](https://bitdefender.ai/docs/onboard-mcp.png)
_Step 5 · every MCP server verified before you decide_

![Apply summary: credentials blocked, MCP decisions written with a backup of the previous policy, then a scan finding three issues, two auto-fixable.](https://bitdefender.ai/docs/onboard-apply.png)
_Step 7 · policy applied, then scanned against_

## Everyday commands

Everything below is also in aiguardian --help (and every subcommand answers --help itself). Commands print a clean report in the terminal; the interactive ones open a full-screen browser you leave with `Esc`.

| Command | What it does |
| --- | --- |
| `aiguardian` | Same as aiguardian scan — the default. |
| `aiguardian scan [agent]` | Scan an agent’s config for issues and fix them. Without an agent it opens the picker. |
| `aiguardian onboard` | Launch (or re-run) the onboarding wizard. |
| `aiguardian status` | One-screen overview: protection, alerts and plan at a glance. |
| `aiguardian audit` | Interactive audit-log browser. |
| `aiguardian allowlist` | Browse the allow rules you have saved. |
| `aiguardian mcp status` | Print every MCP server on this machine and the policy action on each. |
| `aiguardian mcp review [agent|all]` | Re-review MCP servers and update each server’s keep/remove action. |
| `aiguardian mcp login <server>` | One-time browser sign-in to an MCP server that requires authorization. |
| `aiguardian mcp logout <server>` | Forget the stored authorization for an MCP server. |
| `aiguardian skills [agent|all]` | Re-review the skills installed for a protected agent. |
| `aiguardian agents` | Change which AI agents are protected. |
| `aiguardian credmon` | Manage the credential paths blocked from AI access. |
| `aiguardian notifications` | Reconfigure the alert platform and DM target. |
| `aiguardian hook reinstall <agent>` | Force-reinstall the guardian hook for an agent — recovers a stale or disabled hook. |
| `aiguardian feedback` | Send feedback to Bitdefender from a short in-terminal form. |
| `aiguardian about` | Product version and third-party license information. |

![aiguardian status: headline “Protected”, 12 credential paths blocked, MCP tally of 4 trusted and 2 removed, Claude Code guardian plugin armed, telegram DM alerts, subscription active.](https://bitdefender.ai/docs/status.png)
_aiguardian status · the one-screen overview_

![aiguardian scan results for OpenClaw: three issues, two auto-fixable warnings about network exposure and unsafe tool calls, one manual info item.](https://bitdefender.ai/docs/scan-findings.png)
_aiguardian scan · findings with one-key auto-fix_

![aiguardian mcp status: OpenClaw servers listed with allow and remove actions; Claude Code servers all allowed, including a per-project scope.](https://bitdefender.ai/docs/mcp-status.png)
_aiguardian mcp status · every server, and what policy does with it_

## Verdicts and policy

AI Guardian uses a small, consistent vocabulary everywhere — the wizard, the audit log, and alerts:

- **PASS** — The action was checked and allowed to proceed.
- **WARN** — The action went through but was flagged for your review.
- **BLOCK** — The action was stopped before it ran.

### MCP server actions

For MCP servers, policy stores one of two standing decisions per server:

- **allow** — Trusted — the agent may use it.
- **remove** — Taken out of the agent’s config (the original is backed up first).

_Scan findings are labelled auto-fix or manual. Auto-fixes are applied only when you select them; manual items come with exact guidance on what to change._

## The audit log

aiguardian audit opens a calendar of everything AI Guardian checked — encrypted, local, and grouped the way you'd investigate it.

- The calendar colours each day by its worst event; the panel previews the selected day.
- Open a day to stream its events, grouped by agent run, with lenses for Blocked / Flagged / Allowed.
- Open an event to see the full decision: the reason, the request that triggered it, and the result.
- From a blocked or flagged event, press `a` to allow it going forward — that saves an allow rule.

![Audit calendar for August 2026 with days coloured by severity, a day panel with recent events, and an attention callout for a blocked sensitive-file access.](https://bitdefender.ai/docs/audit-calendar.png)
_aiguardian audit · the calendar_

![A single day’s event stream: a blocked sensitive-file access, a flagged skill, and passing checks — each with a severity chip, a plain-phrase summary and a category tag.](https://bitdefender.ai/docs/audit-day.png)
_One day · the full event stream_

![Event detail: “Blocked by Credentials Monitor” — “Suspicious file path in tool arguments: ~/.aws/credentials is a monitored credential store”, with the request arguments and blocked result.](https://bitdefender.ai/docs/audit-detail.png)
_Event detail · the reason, the request, the result_

## Allow rules

An allow rule is a saved exception: “this tool, on these files, is fine.” Rules are written where you make the decision — press `a` on an audit event, or allow a flagged skill or MCP server during a review — and are as narrow as that moment: a tool name, an MCP server, a file path or glob, the exact findings you looked at.

Pressing `a` on an event opens the rule builder: a checklist of exactly what that event touched. Tick the parts the exception should cover with `Space` — the preview spells out in plain language what the rule would allow — edit a file path with `e` or widen it to a glob preset with `g`, then save with `Enter`. Nothing is saved until you do.

aiguardian allowlist shows every rule in plain language, with how often it matched and when it last fired, so stale exceptions are easy to spot and remove.

![Allow-rule builder on a blocked event: an “Allow this?” checklist with tool read_file and file path ~/.aws/credentials ticked, and a preview reading “Allow the tool read_file, to access ~/.aws/credentials.”](https://bitdefender.ai/docs/allow-builder.png)
_Press a on an event · the rule builder_

![Allow rules browser: three rules in plain language — a tool allowed under a project folder, an MCP server tool pairing, and one file path — with hit counts.](https://bitdefender.ai/docs/allowlist.png)
_aiguardian allowlist · saved exceptions, in plain language_

## Alerts

When something needs your eyes — a blocked tool call, a flagged skill — AI Guardian can DM you on the chat platform you picked during onboarding. Alerts go to a private 1:1 conversation, never a group.

Change the platform or the DM target at any time with aiguardian notifications. The audit browser shows the same attention items at the top of its calendar, so nothing depends on the DM arriving.

## Privacy & telemetry

Decisions are made locally. Skill scans and policy checks run on your Mac, and the audit log is stored encrypted on your machine.

During the BETA, anonymous reporting is on for every install — onboarding states it up front (`p` on that screen opens the privacy policy) rather than asking, and the build ships without an off switch. It covers protection decisions only: how often a tool call was blocked or a skill was flagged, and which scanners fired. It never includes prompt contents, file contents, credentials, or anything your agents processed.

## Related

- [AI Guardian](https://bitdefender.ai/): the flagship agent-security product
- [All context](https://bitdefender.ai/llms-full.txt)

## Legal

No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the type of agents used. Features and availability may vary. Initially available on macOS, with further platforms to follow.