# AgentWarden

> AgentWarden is "antivirus for AI": desktop security software that watches AI coding agents (Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI and others) on your own computer, compares what they actually do against what you asked them to do, and alerts you when an agent is hijacked by prompt injection, a malicious skill or MCP server, or goes off-task. Made by PRAESI TECHNOLOGIES LTD (Cyprus).

## What it does
- Reads agent session logs locally and judges every command against the user's actual request ("on task", "not part of the task", "looks like an attack").
- Detects indirect prompt injection in content an agent reads (web pages, PR titles, issues, MCP tool results, skills) and escalates the next sensitive off-task action as a likely hijack.
- Catches credential theft, secrets posted to pull requests, data exfiltration, persistence, disabling of security tools, agent self-modification (e.g. switching to no-approval mode) and supply-chain attacks such as publishing packages or installing from unofficial registries.
- Scans installed agent skills, plugins and MCP servers for malicious instructions before they run.
- Decoys and traps (Pro): fake credential files and trails that no legitimate task touches. A hijacked agent that asks for a real key by name can be handed the decoy instead, so it believes it succeeded while the real file is never opened. New decoys arrive with updates.
- Shows on its main page what it protects from (the number of known AI attacks and malicious tools it recognises, counted from its signed updates) and what updates added this week.
- Optional containment: after rehearsing on the user's machine, it can refuse a single dangerous action or pause only a session judged hijacked. It never touches the user's own terminal or remote access (Jump Desktop, RustDesk, Parsec, Chrome Remote Desktop and similar).
- Recognises ~30 AI agents and agentic IDEs, from a signed catalogue updated without app releases.
- Everything is analysed on-device. Code, prompts and transcripts are never uploaded.
- Detection rules are signed, updated continuously, and tested against real 2026 attacks on AI agents. Mac and Windows pass the same checks (over 2,800 each) before any release.

## Platforms
- macOS 14+ on Apple silicon (M1 and later): available now, signed and notarised.
- Windows 10/11: from the Microsoft Store (https://apps.microsoft.com/detail/XP99T6BPX8T56J), signed by PRAESI TECHNOLOGIES LTD. The app keeps itself up to date.
- Linux: in testing.
- iPhone companion app for end-to-end encrypted alerts.

## Pricing (the price shown is the total charged at checkout)
- Free: monitoring on one computer, forever.
- Pro: €14.99/month or €99/year (early-bird: subscribe before 31 December 2026 and the price never rises while you stay subscribed). 20% off the first payment when invited by a friend; the friend gets a free month. Includes supply-chain scanning, tripwires, email and phone alerts, up to 3 devices. 14-day free trial, no card. 14-day money-back promise.
- Pro for Teams: Pro for 2-99 people on one invoice, billed yearly per person with volume pricing (2-4 people €99, 5-19 €89, 20+ €79 each). 3 computers per person, one activation link, a team page to free seats. 100+ people (Enterprise): email operations@praesi.ai.

## Links
- [Website](https://agentwarden.praesi-technologies.com/)
- [Pricing](https://agentwarden.praesi-technologies.com/#pricing)
- [What it cannot do](https://agentwarden.praesi-technologies.com/#honest)
- [Security & vulnerability reporting](https://agentwarden.praesi-technologies.com/security/)
- [Privacy Policy](https://agentwarden.praesi-technologies.com/privacy/)
- [Terms of Service](https://agentwarden.praesi-technologies.com/terms/)
- Support: https://agentwarden.praesi-technologies.com/support/ (report a problem, false alarms, security reports; operations@praesi.ai). In the app: Report a problem, and This alert was wrong on each alert.

## Guides
- [What is antivirus for AI agents?](https://agentwarden.praesi-technologies.com/guides/antivirus-for-ai-agents/)
- [How to secure Claude Code on your computer](https://agentwarden.praesi-technologies.com/guides/secure-claude-code/)
- [How to secure Codex, Cursor and other AI coding agents](https://agentwarden.praesi-technologies.com/guides/secure-ai-coding-agents/)
- [Detecting prompt injection in AI coding agents](https://agentwarden.praesi-technologies.com/guides/prompt-injection-coding-agents/)
- [Checking MCP servers and agent skills for malicious instructions](https://agentwarden.praesi-technologies.com/guides/mcp-server-skill-security/)
- [Full text of the site for AI assistants](https://agentwarden.praesi-technologies.com/llms-full.txt)

## Version
- Latest release: 2.5.101 (2026-10-19). Release notes: https://agentwarden.praesi-technologies.com/releases/

## Questions and answers
Q: Will it slow my computer down?
A: No. It uses around 1% of the processor and sits still. No constant animation, nothing that heats your machine.

Q: What does Stop AI do?
A: It is the emergency stop. One press on the Live page pauses every AI agent on your computer and everything they started, makes Claude Code refuse every new action (while containment is on, as it is by default), and switches off MCP servers in your agents’ settings, with a copy of each file kept first. Your terminal, your remote access and your keys are never touched. That stops an attack using them while it is under way. It cannot undo what already ran, and it cannot stop something that is not running through an AI agent. Resume AI lets each agent carry on where it stopped and puts back exactly what was switched off. Anything you changed in the meantime is left as you left it, and shown to you. It is free on every plan.

Q: Will it interrupt my work?
A: No. Only a session judged to be hijacked is ever stopped, and containment spends its first week learning your work without changing anything. The one exception is a proven attack, such as an agent running a command copied out of a page it just read: that one agent is paused for 5 minutes, even in the first week, and you can resume it at any time. It never touches your terminal, your shell or remote access like Jump Desktop, RustDesk or Parsec.

Q: Does anything leave my computer?
A: Your code and transcripts never do. Alerts go only where you send them: your paired phone, sealed so nothing in between can read them, or your email if you turn that on. An email alert carries one line about what happened, never your code, commands or file names. Activating a licence sends your email and a one-way fingerprint of the computer.

Q: Does it update itself?
A: Yes, by default. Detection rules and the known-threat list update on their own. The app installs its own updates only when no agent has been busy for 10 minutes, and restarts in the background. Your window comes back exactly where you had it: minimised if it was minimised, behind your work if it was open there, and in front only if you were looking at AgentWarden itself. It never appears over what you are typing. Switch it off in Updates and you get one notification per new version instead.

Q: Something isn’t working. How do I tell you?
A: In the app: Report a problem, in Settings or the Help menu. It shows exactly what will be sent before you send it, and never includes your files or code. Each alert also has “This alert was wrong”. Or use the Support page, or email operations@praesi.ai. A person reads every report.

Q: Mac and Windows?
A: Both, with the same engine, the same rules and the same tests: every release passes the same checks on both, over 2,800 of them, or it does not ship. macOS 14 or later on Apple silicon (notarised by Apple) and Windows 10 or 11 (from the Microsoft Store). Linux and the iPhone companion are on the way.

Q: Does it keep running?
A: Yes, quietly. It starts when you sign in and stays in the menu bar or system tray. If it ever stops unexpectedly, it comes back by itself in the background, without a window over what you are doing. Quit it on purpose and it stays quit until you open it again. You can turn off starting at sign-in in System Settings or Windows Settings, and the app tells you if something has switched it off.

Q: What does the Pro checkup show?
A: Five answers, on the Health page. Which skills and MCP servers are new or changed since you last looked. When CLAUDE.md, AGENTS.md or project settings changed. What each agent is allowed to do without asking you, read from its own settings. Which keys and credential files an agent could reach, whether a decoy stands in front of each, and whether an agent has reached for one. And whether your safety nets are in place, should an agent delete or break something: backups, restore points, and projects with a copy elsewhere. It only checks file names and settings, never the contents of your keys, and nothing leaves your computer.

Q: Does it add a desktop icon?
A: Only if you want one. On Windows it asks once, and your answer sticks. It is always in the Start menu.

Q: How do I know it is working?
A: The main page tells you: whether you are protected, how each of your AI tools is covered and when it was last active, how many known AI attacks and malicious tools it recognises, what updates added this week, your four layers of protection, and this week in numbers, including any time an attacker was handed a decoy instead of your real files. Zero attacks is a fine answer; it means nothing got through.

Q: Which agents does it cover?
A: About 30: Claude Code, Codex, Cursor, Gemini CLI, Copilot, Windsurf, Kiro and more. Claude Code and Codex are checked step by step against what you asked; the rest are recognised running, with their commands, skills and settings checked. The list updates itself.

Q: What can’t it do?
A: No security tool catches everything. If an action is already running, or the agent has no hook support, AgentWarden detects it but can’t stop it. Rules can be evaded, which is why there are decoys and daily rule updates. And it’s protection for a person’s own computer, not enterprise endpoint security.

Q: Is there a discount if I recommend it?
A: Yes. Send a colleague your link from the app. They get 20% off their first payment, and when they subscribe you get a free month of Pro, up to three times.


## What AgentWarden cannot do
Security software earns trust by being honest about its edges. These are ours.
It cannot stop everything.
A hijacked session is refused or diverted before a sensitive action runs. But a process already mid-flight, or an agent with no hook support, is detected rather than stopped. Your agent’s own sandbox is still the strongest protection, and AgentWarden shows you whether it is on.
Depth depends on the agent.
Claude Code and Codex are read in full detail, because their session logs are read directly and every step is judged against what you asked. About thirty other agents are recognised running: the commands they start, their skills and their settings are checked, but they are not yet read line by line.
It cannot see inside another sandbox.
Some tools run AI agents inside a sealed sandbox of their own, a container or a virtual machine. NVIDIA OpenShell is one. What an agent does in there never reaches your computer, so AgentWarden cannot watch it. It still lists the tool with your AI tools and tells you plainly that it cannot see inside. On Windows, a tool installed only inside WSL is not seen at all.
Patterns can be evaded.
Rules are patterns, and a new technique can slip past one. The decoys, and the “read hidden instructions, then acted” link, exist to catch what individual rules miss. The daily research loop turns newly published attacks into signed rule updates, usually the same day.
It is not enterprise endpoint security.
AgentWarden is strong personal-grade protection for the computer it runs on, with no kernel-level enforcement and no independent audit yet. We would rather you knew that now.

## What is antivirus for AI agents? (https://agentwarden.praesi-technologies.com/guides/antivirus-for-ai-agents/)
AI coding agents such as Claude Code, Codex and Cursor run commands, read files and install tools on your computer. Antivirus for AI agents watches what they actually do and tells you when an agent stops working for you.
### Why agents need their own protection
- Classic antivirus looks for known malicious files. An AI agent is a trusted program you started yourself, so its actions look legitimate to the operating system even when they are not.
- Agents read content written by other people: web pages, issues, pull requests, documentation, tool results from MCP servers and skills. Text in that content can carry hidden instructions (indirect prompt injection) that steer the agent towards something you never asked for, such as reading your keys or sending data out.
- The risk is not only attacks. An agent can also drift off task, delete the wrong folder or switch itself to a mode that no longer asks you before acting.
### What it watches
- Each step an agent takes, compared with the task you gave it: on task, not part of the task, or looks like an attack.
- The content an agent reads, so an instruction hidden in a page or tool result can be linked to the sensitive action that follows it.
- The skills, plugins and MCP servers an agent can load, checked for malicious instructions before they run.
- High-risk actions: credential and key access, secrets posted to pull requests, data exfiltration, persistence, disabling security tools, an agent changing its own settings, and supply-chain actions such as publishing packages or installing from unofficial registries.
### How AgentWarden does it
- AgentWarden runs on your own Mac or Windows PC and analyses everything on the device. Your code, prompts and transcripts are never uploaded.
- Claude Code and Codex are read step by step from their own session logs and judged against what you asked. About thirty other agents and agentic IDEs are recognised running, with their commands, skills and settings checked.
- Decoys and tripwires (Pro) catch what rules miss: fake credential files that no legitimate task touches. A hijacked agent that asks for a real key by name can be handed the decoy instead.
- It watches by default. Containment, when on, acts only on a session judged to be hijacked, and never touches your own terminal, shell or remote access.
### What it cannot do
- No security tool catches everything. An action already running, or an agent without hook support, is detected rather than stopped. Rules can be evaded, which is why decoys and frequent signed rule updates exist. AgentWarden is personal-grade protection for the computer it runs on, not enterprise endpoint security. The full list is on the Limits page.
Q: Is antivirus for AI agents the same as normal antivirus?
A: No. Normal antivirus looks for malicious files. Antivirus for AI agents watches trusted agents you started yourself and judges their actions against the task you gave them.
Q: Does AgentWarden upload my code?
A: No. Everything is analysed on your device. Code, prompts and transcripts never leave your computer.
Q: Which agents does it cover?
A: About 30, including Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, Windsurf and Kiro. Claude Code and Codex are checked step by step; the rest are recognised running, with commands, skills and settings checked.

## How to secure Claude Code on your computer (https://agentwarden.praesi-technologies.com/guides/secure-claude-code/)
Claude Code can read your files and run commands in your terminal. A few habits make it much harder for a mistake or a hijack to cost you, and a watcher on the machine catches what slips through.
### 1. Keep approvals on
- Let Claude Code ask before it runs commands or edits files outside the project, especially in repositories you did not write. Modes that skip every approval are convenient, but they remove the moment where you would notice something odd.
- Allow specific, harmless commands instead of allowing everything.
### 2. Use the sandbox
- Run agents inside the strongest sandbox your setup offers, so a bad command cannot reach the rest of your computer. Your agent's own sandbox is still the strongest protection.
### 3. Keep secrets out of reach
- Do not keep production keys, wallet phrases or password exports in the project folder or in files an agent reads by default. Use a password manager or a secrets store, and give agents short-lived, limited tokens.
### 4. Be careful with what it reads
- Web pages, issues, pull request text and tool output can contain instructions written for the agent, not for you. Be suspicious when an agent suddenly wants to read credentials, change its own settings or send data somewhere right after reading outside content.
### 5. Review MCP servers, skills and project instructions
- Install MCP servers and skills only from sources you trust, and look again when they change. Watch for changes to CLAUDE.md, AGENTS.md and project settings, which steer every future session.
### 6. Have a way back
- Commit often, keep a copy of important projects elsewhere and keep backups or restore points, so a destructive command is an inconvenience, not a loss.
### What AgentWarden adds for Claude Code
- AgentWarden reads Claude Code session logs on your machine and judges every step against what you asked. It flags off-task and attack-like actions, links a hidden instruction in content the agent just read to the sensitive action that follows, and scans skills and MCP servers before they run.
- With containment on, it can make Claude Code refuse a single dangerous action or pause only a session judged hijacked. Stop AI, free on every plan, pauses every agent at once and switches off MCP servers in your agents' settings, keeping a copy of each file first.
- The Pro checkup on the Health page shows which skills and MCP servers are new or changed, when CLAUDE.md, AGENTS.md or project settings changed, what each agent may do without asking, which credential files an agent could reach, and whether your safety nets are in place.
Q: Is it safe to run Claude Code without approvals?
A: It is riskier. Without approvals nothing stops a mistaken or hijacked command before it runs. Keep approvals on for unfamiliar repositories and allow only specific harmless commands.
Q: Can AgentWarden stop Claude Code?
A: Yes, with containment on it can refuse a single dangerous action or pause a session judged hijacked, and Stop AI pauses every agent at once. An action already running is detected rather than stopped.
Q: Does AgentWarden slow Claude Code down?
A: No. It uses around 1% of the processor and never interrupts your work unless a session is judged hijacked.

## How to secure Codex, Cursor and other AI coding agents (https://agentwarden.praesi-technologies.com/guides/secure-ai-coding-agents/)
The same rules keep every AI coding agent safer, whichever one you use. This checklist works for Codex, Cursor, Gemini CLI, GitHub Copilot, Windsurf, Kiro and the rest.
### The checklist
- Use the agent's sandbox and approval settings, and keep stricter settings for code you did not write.
- Never paste or store real secrets where the agent works. Prefer short-lived, limited tokens.
- Treat everything the agent reads from outside (pages, issues, pull requests, package docs, MCP tool results) as untrusted input that may contain instructions.
- Install skills, plugins and MCP servers only from sources you trust, and review them when they update.
- Watch for an agent changing its own configuration, especially switching to a mode that no longer asks you.
- Be wary of package publishing, installs from unofficial registries and new startup items that you did not request.
- Keep backups and a copy of important projects elsewhere.
### Seeing what every agent does
- Most people run more than one agent. AgentWarden recognises about thirty AI agents and agentic IDEs from a signed catalogue that updates without app releases, and shows each one on its Live page with when it was last active.
- Codex and Claude Code are read in full detail: every step is judged against what you asked. For the others, the commands they start, their skills and their settings are checked, but they are not yet read line by line.
- Everything runs on your own Mac or Windows PC. Code and transcripts are never uploaded.
### Limits worth knowing
- Some tools run agents inside a sealed container or virtual machine of their own. What happens in there never reaches your computer, so AgentWarden cannot watch it, and it tells you so. On Windows, a tool installed only inside WSL is not seen. See the Limits page.
Q: Does AgentWarden work with Codex?
A: Yes. Codex is read step by step from its session logs and every step is judged against what you asked, like Claude Code.
Q: Does it work with Cursor?
A: Cursor is recognised running, and the commands it starts, its skills and its settings are checked. It is not yet read line by line.
Q: Mac or Windows?
A: Both, with the same engine and the same rules: macOS 14 or later on Apple silicon, and Windows 10 or 11 from the Microsoft Store.

## Detecting prompt injection in AI coding agents (https://agentwarden.praesi-technologies.com/guides/prompt-injection-coding-agents/)
Indirect prompt injection hides instructions in content an agent reads. The agent cannot always tell your request from an attacker's text, so it may follow the wrong one.
### How it happens
- An agent fetches a web page, reads an issue or pull request title, opens a dependency's documentation or receives a result from an MCP server. Somewhere in that text is an instruction aimed at the agent: read this file, run this command, send this value to that address.
- Because the agent has your permissions, a successful injection acts with your access.
### Warning signs
- An action that has nothing to do with the task, right after the agent read outside content.
- Reading credential files, cloud keys, SSH keys or wallet files during an unrelated task.
- Running a command copied out of a page it just read.
- Posting secrets into a pull request, an issue or a web request.
- Changing its own settings, for example switching off approvals.
### How AgentWarden catches it
- AgentWarden detects instructions hidden in content the agent reads and escalates the next sensitive, off-task action as a likely hijack. Running a command copied out of a page it just read counts as a proven attack: that one agent is paused for 5 minutes, and you can resume it at any time.
- Decoys catch what patterns miss. A hijacked agent hunting for secrets finds a trail of fake credentials that no legitimate task touches, and every step deeper raises a more certain alert. The upload address in the trail can never resolve, so nothing leaves.
- Detection rules are signed and updated continuously from published research and advisories.
Q: What is indirect prompt injection?
A: Instructions hidden in content an AI agent reads, such as a web page, issue or tool result, that steer the agent to do something the user never asked for.
Q: Can prompt injection be fully prevented?
A: No tool catches every case. Keeping approvals on, limiting what the agent can reach and watching for off-task actions after outside content are the practical defences.
Q: Does AgentWarden block injected commands?
A: With containment on, a session judged hijacked can be paused or a single dangerous action refused. A proven attack, such as running a command copied from a page, pauses that agent for 5 minutes even in the first week.

## Checking MCP servers and agent skills for malicious instructions (https://agentwarden.praesi-technologies.com/guides/mcp-server-skill-security/)
MCP servers, skills and plugins extend what an agent can do. They also add text and tools the agent will trust, which makes them an attractive way in for attackers.
### Why they are risky
- A skill or MCP server can carry instructions the agent follows as if they were yours, or return tool results that contain them. An update can change a harmless one into a harmful one.
- They often run with your permissions and can reach your files, network and keys.
### Before you install one
- Prefer well-known publishers and read what the server or skill is allowed to do.
- Look for instructions that have nothing to do with its purpose, such as reading credentials, contacting unknown addresses or changing agent settings.
- Pin versions where you can and look again when they change.
- Remove the ones you no longer use.
### How AgentWarden helps
- AgentWarden scans installed agent skills, plugins and MCP servers for malicious instructions before they run, and checks the tools an agent loads against its signed, regularly updated known-threat list.
- The Pro checkup shows which skills and MCP servers are new or changed since you last looked.
- Stop AI switches off MCP servers in your agents' settings in one press, with a copy of each file kept first, and Resume AI puts back exactly what was switched off.
Q: What is an MCP server?
A: A Model Context Protocol server gives an AI agent extra tools and data, such as access to a database, a browser or a service. The agent trusts what it returns.
Q: Can an MCP server hijack an agent?
A: Yes. Its tool descriptions or results can contain instructions the agent may follow. That is why servers should come from trusted sources and be checked when they change.
Q: Does AgentWarden check MCP servers?
A: Yes. It scans installed skills, plugins and MCP servers for malicious instructions before they run, and Pro shows which ones are new or changed.