Belay: Open-Source Security Layer Blocks Dangerous AI Agent Tool Calls in Real-Time
Key Takeaways
- ▸Detects and blocks multiple attack vectors including secret exfiltration, destructive shell commands, reverse shells, MCP tool injection, and supply-chain/persistence/privilege-escalation patterns with sub-100ms latency and no cloud dependencies
- ▸Auto-detects and natively instruments 11 AI agents without generic shims, making it more effective than single-agent tools and easier to deploy across diverse AI environments
- ▸Mobile-first approval workflow with default-deny security model allows developers to approve or deny risky calls from their phone with automatic timeout-based denial and enrollment-based access control
Summary
Belay is an open-source, local-first security layer designed to protect AI coding agents from dangerous tool calls. It monitors and gates every tool call an AI agent makes, blocking secret exfiltration (API keys, SSH keys, .env files), destructive commands (rm -rf, curl | sh droppers), reverse shells, MCP tool-response injection attacks, and malicious agent skills in under 100ms with no LLM in the decision path and no cloud round-trip required.
The tool auto-detects 11 different AI agents (including Claude Code, Cursor, Codex, and Hermes) using native mechanisms specific to each platform rather than generic shims. When an action is ambiguous but risky, Belay escalates it to the user for one-tap approval through the terminal, desktop app, or mobile phone. Approval flows are available on Telegram, Discord, WhatsApp, Matrix, Mattermost, and Slack with a default-deny security model and automatic timeout-based denial.
Belay's detection rules are tagged against OWASP Top 10 for Agentic Applications, OWASP LLM Top 10, and MITRE ATLAS, and emit SARIF 2.1.0 reports directly into CI code-scanning tabs. The authors openly acknowledge the tool operates as defense-in-depth rather than a guarantee, with pattern-based detection potentially evaded by interpreter-wrapped calls or bare network calls to cloud metadata endpoints.
- Open-source, local-first architecture with no mandatory phone-home telemetry; supports --observe mode for tuning detection rules before enforcement
