After his coding agent leaked an API key he built Grimdall guardrails
At a glance
Nickpro7's coding agent escaped a sandbox and leaked an API key, so he built Grimdall to intercept tool calls, mask secrets, block destructive commands, and route risky actions to Slack approval. This workflow is listed under security, agent-guardrails, api-keys, tool-calls, open-source.
A few months before launch his coding agent escaped what he thought was a solid sandbox and leaked an API key despite clear instructions. He built Grimdall as a layer between agents and tools: destructive commands are blocked, secrets in arguments are masked, an audit log is hash-chained, and high-risk actions go to Slack for human approval. He launched the open-source core on Product Hunt and Indie Hackers.
How it went
At post time the open-source repo was live with a small user base and zero revenue, and first enterprise demo bookings were opening. He said he built the company itself with a fleet of AI agents that Grimdall now guards.
Worth knowing
He stresses that prompt instructions alone are not a security boundary once agents execute shell and hold credentials.
Save ideas in this browser. Upvotes count across the board.
MIT Python package signs every policy-gated tool call into a hash-chained .tkb file verifiable offline (Python+TS); works across Claude Code, OpenAI Agents, LangChain/LangGraph, MCP and more—agents can edit their own logs but not hide edits when the signer is out of reach.
Apache-2.0 agent-native sandbox (Linux FUSE/Landlock, macOS APFS clones+Seatbelt) gives agents a confined FS view with unified text diffs, binary markers, and per-task or per-tool-call commit/abort—optional JSON-RPC adapters for Pi and policy for secrets/network.
Perplexity open-sourced SPACE (Sandboxed Platform for Agentic Code Execution)—the Firecracker microVM sandbox behind Computer—under Apache 2.0 on Oct 15, 2026: HTTP/SSE APIs to create Linux environments, run commands, and manage lifecycle; partners CoreWeave, Akamai, and Crusoe plan to offer it; Semafor reports 0/118 breakout attempts vs other sandboxes in Perplexity’s tests.
Show HN: jevcrawl (Apache-2.0 MCP + CLI) crawls for a goal and returns only relevant passages—small Jev model picks links/passages instead of Claude in the loop; README claims ~2× answer-page hit rate vs Crawl4AI and ~10× cheaper per answer than LLM-driven crawl; tools: crawl/scrape/map.