Vigiles
macOS LLM filesystem firewall. Know what your AI is doing. Control what it can touch.
The Gap
LLM agents read, write, and execute files on your machine. The tools that host them — Claude Code, Cursor, Gemini CLI — each have their own permission models, but those permissions are enforced at the application level. A misconfigured agent, a prompt injection, or a tool-use chain that escalates beyond its intended scope can bypass application-level controls entirely.
The filesystem does not know the difference between a file operation you requested and one an AI decided to perform on its own.
The Approach
Vigiles intercepts file operations at the kernel level using Apple's Endpoint Security framework. Every open, create, delete, rename, truncate, execute, link, and clone event passes through the kernel before it reaches disk. Vigiles evaluates each operation against user-defined policy rules and blocks or allows it — regardless of which application initiated it.
This is not a wrapper around the AI tool. It is a firewall between any tool and the filesystem. A proxy can be bypassed by a misconfigured agent. The kernel cannot.
How It Works
A system extension subscribes to Endpoint Security AUTH events. A process identifier determines whether the responsible process is an LLM agent — by path, bundle ID, parent process chain, code signing identity, or user-defined patterns. Non-LLM processes pass through immediately. LLM processes are evaluated against the policy engine.
Policies are defined as rules: file path patterns, operation types, and allow/deny decisions. A live event feed in the menubar shows every intercepted operation and its verdict. An on-device SQLite log records every event for review.
Privacy
All policy evaluation and event logging happen on-device. Vigiles has no network component, no telemetry, and no cloud dependency.
FAQ
- What is Vigiles?Vigiles is a macOS application that acts as a real-time firewall between LLM agents and your local filesystem. When an AI tool attempts to read, write, delete, or execute files, Vigiles intercepts the operation at the kernel level and blocks or allows it based on your rules.
- How is Vigiles different from wrapping AI tools in a proxy?Proxy-based approaches wrap the LLM's subprocess calls — they can be bypassed by a misconfigured agent. Vigiles intercepts at the kernel level via Apple's Endpoint Security framework. Every file operation passes through the kernel, regardless of how the AI agent is configured.
- Does Vigiles send data anywhere?No. All policy evaluation and event logging happen on-device. Vigiles has no network component, no telemetry, and no cloud dependency.
Status
Vigiles is in alpha development for macOS.