LLM door on loopback
Proxy binds to 127.0.0.1:8788. Agent LLM calls route through BARZEL before reaching upstreams such as openrouter.ai and api.anthropic.com.
Private preview · independent
Your AI agents talk to models all day. BARZEL judges every word.
A lightweight host policy agent for AI agents. It stands as an LLM door on your machine, classifies traffic, and denies what should not pass — fail-closed by design.
One door. Clear verdicts.
BARZEL sits on loopback as the LLM door for agent traffic. Every request is judged — classify or deny — and unclassified traffic never silently passes.
Judge: classify / deny
A deterministic pre-filter plus an LLM judge scores prompts and completions for injection, exfiltration, and jailbreak patterns. Fail-closed — never pass through unclassified traffic.
Observe first
Default posture is observe. Host mutation stays off until you opt in. Mac Hermes pilot runs with BARZEL_ENFORCE=0 so you can see before you act.
Three named postures
Not every host needs the same risk. Watch, Guard, and Fortress make the tradeoff explicit — capability sets, not buried flags.
Watch
Default · zero mutation
- Full LLM traffic classification
- Live traffic and deny log
- Zero host mutation capability
- Safe on daily-driver machines
Guard
Single-host operators
- Everything in Watch
- Process quarantine (pause / resume) with revert
- Protected-PID and allowlist safeguards
- Dual-gate: policy + explicit env flag
Fortress
Hardened / disposable hosts
- Everything in Guard
- Network egress allow-listing
- DNS sinkholing, NIC isolation
Linux-oriented today. Not for daily-driver machines — misconfiguration can lock you out of the host.
Controls you can see
Policy posture is visible, not magical. Enforcement is dual-gated so a tier change never silently turns mutation on.
Fail-closed doors
LLM, DNS, and egress doors fail closed. If the judge cannot classify, the request does not pass. Process and NIC stay fail-open unless Fortress-class controls are intentionally enabled.
Dual-gate enforce
Setting a tier alone does not activate host mutation. Enforcement requires both policy mode and an explicit env flag (for example BARZEL_ENFORCE=1). Pilot default remains BARZEL_ENFORCE=0.
Loopback console
A local console shows traffic volume, denies with reasons, and an audit trail of actions — one pane for operators, read from the host that runs the door.
Upstream awareness
Designed around real agent paths to openrouter.ai and api.anthropic.com. The door judges what agents send and receive on the host you control.
What BARZEL is not
Not a public cloud product
Private preview. Independent host policy agent. Install and access are invite or pack based — no public package registry install URL.
Not an enterprise SOC replacement
Single-host posture for AI agent traffic and optional host actions. Not a fleet SIEM, not a cloud CNAPP.
Not enforce-by-default
Observe first. Fortress-class network controls are for hardened or disposable Linux hosts — documented caveats, not silent upsell.
Private access
BARZEL ships Watch-first. Source lives in a private repo. No public install URL, no API keys on this page.
Request access
Private preview for design partners and operators running AI agents on a host you control.
Get started — ops@avatar33.comOperator facts
- LLM door:
127.0.0.1:8788 - Health:
127.0.0.1:8791 - Pilot: observe ·
BARZEL_ENFORCE=0 - Upstreams: openrouter.ai · api.anthropic.com
- Repo: private ·
github.com/f-o-x11/barzel
# Mac Hermes pilot posture (illustrative)
# BARZEL_ENFORCE=0 observe, no host mutation
# door listens on 127.0.0.1:8788
# judge classify / deny · fail-closed