Sentinel-class monitor · for AI agents

Every move your AI makes, on the record.

AI agents now delete files, send data and spend money — on their own. Siphrix records every action and flags the dangerous ones by severity. It never blocks, never breaks, never phones home.

WatchesChatGPT · Claude · Gemini
Copilot · coding agents
Setupunder one minute
Storesmetadata only · locally
Blocksnothing — by design
■ CRITpayment_action ▲ HIGHshell_command ● LOWread_file ▲ HIGHupload_file observing · not interfering
● REC SESSION 5026-0413 · ALL AGENTS 0 ENTRIES NOTHING BLOCKED · EVERYTHING ON RECORD
SEC//01 — The blind spot

Your AI already acts in your name. Nobody is watching.

Every tool you connect can touch files, reach the internet and move money. Siphrix is the page you check afterwards — and the alarm that fires before you have to.

THREAT / 01

It deletes files

One misread instruction and a folder is gone — and without a record, you can't say which agent did it, or when, or why.

■ SEVERITY: CRITICAL
THREAT / 02

It leaks data

A pasted secret, an uploaded document, a message to the wrong place. Siphrix knows the shape of a leak and writes the warning instantly.

▲ SEVERITY: HIGH
THREAT / 03

It spends money

Payments, subscriptions, purchases — agents can do all of it. Every attempt becomes an entry; the dangerous ones rise to the top.

■ SEVERITY: CRITICAL
SEC//02 — The protocol

Connect once. The record writes itself.

01

Link

One click for browsers and editors, one line for coding agents. Siphrix runs beside your tools — never in front of them.

$ pip install siphrix
$ siphrix agent-setup # linked.
02

Record

Files touched, commands run, sites reached, data shared — each becomes one clean, private entry. Metadata only. Never content.

09:41 shell_command · recorded
09:42 http_request · recorded
03

Alert

Anything dangerous-looking is flagged by severity, with the reason in plain language — the moment it happens.

▲ HIGH upload_file → chatgpt.com
■ CRIT shell_command · rm -rf
SEC//03 — Live telemetry

Watch the sentinel work.

A simulated session, playing itself — exactly what your console shows while your agents run. No interaction required. Nothing here is executed.

LIVE TELEMETRY DECK · SESSION 5026-0413 AUTO-REPLAY
0
THREAT INDEX
Entries0
Warnings0
Critical0
Blocked0 — by design
SYSTEM NOMINAL — OBSERVING
“An observer must never break the thing it observes. Siphrix watches everything — and touches nothing.”
— Sentinel design rule // held since v1
SEC//05 — Systems

Everything a record should be.

SYS//AUDIT

Complete

Every decision from every connected surface — browsers, editors, agents on each machine. One timeline, exportable.

SYS//RANK

Ranked by severity

Critical first, low last. Secret-shaped pastes, destructive commands, data egress — flagged the moment they're written.

SYS//READ

Readable

Plain language on the surface, verdicts and reason codes underneath — for the day you need to know exactly what happened.

SYS//RELAY

Loud where you live

One webhook forwards warnings to Slack, PagerDuty or your SIEM. Mute noisy rules; bursts escalate on their own.

SYS//VAULT

Private by construction

Runs on your machine. Metadata only — action, app, verdict, time. Never file contents, never message text.

SYS//ARM

Enforcing, if you insist

Watching is the default. An opt-in enforcement mode can turn any flag into a hard stop — off until you say otherwise.

SEC//06 — Engineers

Your coding agent, on the record.

Claude Code, Codex and MCP-speaking agents link with one command. Every tool call is evaluated and written down before it runs — the audit trail builds itself while you work.

  • Record-only by default — an observer must never break the thing it observes
  • A real policy engine underneath: verdicts, reason codes, decision ids
  • MIT-licensed core · fully offline · a JSON log you own
# one-time setup $ pip install siphrix $ siphrix agent-setup claude hook: installed (monitor mode) codex mcp: installed active policy: dev_agent_defaults # watch the record write $ siphrix audit-tail ALLOW file_read src/app.py ALLOW shell_exec pytest -q FLAG network_access → api.unknown.io · HIGH
SEC//07 — Questions

Fair questions, straight answers.

Do I need to be technical?

No. Siphrix senses your surfaces on its own — you just set how closely each one is watched: Dormant, Standard or Vigilant, in plain words. The technical detail exists underneath for those who want it, and stays out of the way for those who don't.

What happens when something risky is spotted?

It's written down instantly and lands in your Warnings, ranked by severity, with the reason in plain language. Forward it to Slack, PagerDuty or a SIEM if you like. The action itself is not stopped — you stay in charge.

Can it actually block things?

Yes — as an explicit opt-in. Enforcement mode turns flags into hard stops, for those who want prevention rather than a record. It ships off, because a sentinel that quietly interferes with your work is not a sentinel you can trust.

Will it slow down or break my tools?

No. The record is written beside your tools, not in front of them. Even if Siphrix itself fails, your workflow continues untouched — that is a design rule, not a promise.

Where does my data go?

Nowhere, unless you say so. The log lives on your machine as metadata only — action, app, verdict, time. The optional cloud console syncs those same safe entries across your devices. Content never leaves.

Initialize the record.

One minute from now, everything your AI does can be on the page.

Open your console — free
$ pip install siphrix · ChatGPT · Claude · Gemini · coding agents