Agent Sentry Guard

A small system extension that uses Endpoint Security, Apple's framework for security apps, to keep AI agents from reading keys and credentials, and from changing files outside the places you allow. You set the rules in Agent Sentry, and it only answers Agent Sentry.

Agent Sentry Guard

macOS 26 or later · Apple silicon

Download coming soon

What it adds

• Rules for the files agents and everything they start may read, write, rename or delete: SSH keys, cloud and developer credentials, keychains, browser cookies and saved passwords, password managers, private keys, .env files, shell startup files, and login and launch items.
• Rules for the programs they may run, such as osascript and launchctl, which do work outside the agent's reach. A rule covers a renamed copy of the program too.
• Agents confirmed by their maker's signature, also those Agent Sentry can't check from inside its own sandbox.
• Agents followed when their programs detach: a shell left running after its agent quit, or a service macOS starts on its behalf, still counts as the agent's, its connections too.
• Agent Sentry kept running: an agent can't quit or stop Agent Sentry, the Guard or their extensions. Each try is refused and shown on the agent's card as “Tried to quit Agent Sentry”.
• Other ways to a file recorded: linking, cloning or copying it, changing its permissions, owner or attributes, and connecting to the SSH agent or to Docker or Podman.
• Blocking, off until you turn it on in Agent Sentry's Settings › Files › Rules. Until then the Guard only records, and each agent's card shows what a rule would have blocked.

Everything else, including network rules, activity, alerts and the exposure check, works without it.

Install

1. Download the disk image and open it.
2. Drag Agent Sentry Guard to Applications, then open it from there.
3. Click Install Extension.
4. macOS asks you to allow it in System Settings › General › Login Items & Extensions. Turn it on there.
5. Give it Full Disk Access in System Settings › Privacy & Security, so it can see the files agents open.
6. Agent Sentry connects by itself. Its panel says “File protection is active”.

Uninstall

Agent Sentry Guard's window has two buttons. Quitting the app alone leaves the extension running.

Uninstall Guard

Removes the Guard's extension, once you've typed an administrator's password when macOS asks. Then move the app to the Trash. Agent Sentry goes on without file rules.

Uninstall Everything

Removes Agent Sentry and the Guard together: both apps, both extensions, the network filter, your rules, settings and records, and Agent Sentry's keychain item. It can't be undone. It's available while the Guard's extension runs with Full Disk Access, since some of these files only an administrator can delete.

1. Click Uninstall Everything and confirm.
2. Agent Sentry comes forward and asks too. Then macOS asks for an administrator's password to remove its network filter. Cancel either, and nothing is uninstalled.
3. The Guard deletes the files, and macOS asks for the password again to remove the Guard's extension.
4. Agent Sentry Guard moves itself to the Trash. Quit it to finish.

Without Agent Sentry or its network filter, the Guard asks for Touch ID or your login password instead, before it deletes anything. macOS keeps the permissions you gave both apps in System Settings › Privacy & Security, and finishes removing the extensions when the Mac restarts.

Safe by design

• Signed with a Developer ID and notarized by Apple, so macOS checks it before it runs.
• It works through Endpoint Security, Apple's own framework for security apps, built into macOS. It doesn't modify macOS or work around its protections.
• It only accepts connections from apps signed by the same developer, and Agent Sentry checks the Guard the same way.
• It decides from what it already knows, within the time macOS gives it, and never waits on the network or on you.
• It never goes online. It keeps a week of what its rules decided, in its own folder, for Agent Sentry to show.

Check the download

To confirm the file is the one published here, compare its checksum with the one above:

shasum -a 256 ~/Downloads/Agent\ Sentry\ Guard*.dmg