AI Guardian is a security layer for the AI agents running on your Mac. It watches what an agent is about to do — the tools it calls, the MCP servers it talks to, the skills it loads, the files it reaches for — checks each action against a policy you set during onboarding, and answers with a verdict: allowed, flagged, or blocked.
Everything is recorded in a local, encrypted audit log you can browse from the terminal, and anything that needs your eyes can also reach you as a private DM on the chat platform you choose.
More agents are planned.
Two pieces cooperate on your machine — nothing about a decision leaves it:
A small plugin installed into each protected agent (the OpenClaw gateway plugin, the Claude Code hook, the Hermes Agent plugin). It sees lifecycle events — a prompt being built, a tool about to run, a skill being installed — and forwards them for a decision.
A per-user background service that evaluates each event against your policy, writes the audit trail, watches credential paths, and sends alerts. The two talk over a local, user-private socket; the hook side is never trusted blindly.
Your window into both: onboarding, scans, reviews, status, the audit browser and allow rules all live in one terminal command.
AI Guardian installs from the terminal in one command, or from the macOS disk image. Both land on the same notarized Bitdefender package and leave the aiguardian command on your PATH. Step 3 below is where setup actually happens, and the rest of this section walks through it screen by screen.
Two routes, one outcome: both install the same notarized Bitdefender package and leave the aiguardian command on your PATH.
One command. It downloads the package, checks that Apple notarized it and that Bitdefender signed it, and only then installs, so nothing unverified ever runs as root. You are asked for your administrator password once.
OpenClaw
Claude Code
Hermes Agentcurl -fsSL https://ai.bitdefender.com/ai-guardian/install.sh | sudo shNo terminal involved. Download it, open it, and run the installer. The same package and the same checks, performed by macOS rather than by the script.
Open the Bitdefender app and sign in with your Bitdefender account. Activation finishes there, and from that point the Bitdefender agent owns updates and uninstall. Installing over SSH is fine — sign in afterwards from a Mac desktop.
The onboarding wizard finds every supported agent on the machine, scans the skills and MCP servers each one uses, blocks your credential paths, and ends by scanning the config it just wrote. Nothing changes until you confirm it.
aiguardian onboardAfter onboarding, aiguardian on its own re-scans whatever is set up, and aiguardian status prints a one-screen summary of what is protected.
Piping a script into sudo sh means trusting whatever the server sends. The SHA-256 of the script we publish is below, so you do not have to: fetch it, compare, and only run it if the digest matches. The command does that in one line and stops if it does not.
2e6063dd3fd343767c9ee2cc553122727064e89944aa58424f62e23f56d2e883curl -fsSL https://ai.bitdefender.com/ai-guardian/install.sh -o install.sh \
&& echo "2e6063dd3fd343767c9ee2cc553122727064e89944aa58424f62e23f56d2e883 install.sh" | shasum -a 256 -c - \
&& sudo sh install.sh
Onboarding is a short wizard. It never changes anything silently: each step shows what it found, and your config stays as-is until you confirm.
The wizard introduces itself and states the beta terms — continuing means agreeing to the Terms of Service and Privacy Policy (t and p open each in your browser; Esc leaves with nothing installed). A second screen discloses that anonymous reporting of protection decisions is on for the beta.
Every supported agent detected on your Mac is listed with its version and config path. Ticked agents are set up one at a time.
Your installed skills are scanned locally. Clean skills pass; anything suspicious is flagged with the exact finding. Flagged skills default to block — flipping one to allow saves an exception scoped to exactly those findings, so anything new on the same skill still flags.
A default list of credential locations — SSH keys, cloud credentials, tokens — is blocked from agent access. Add your own paths or globs on top.
Each MCP server is verified before you decide. Verified servers default to allow; a server that fails verification — or won’t answer — defaults to remove. You can override either way, and a server that only needs sign-in can be authorized right there (a opens your browser) and re-verified on the spot.
Pick the chat platform where security alerts should reach you as a private 1:1 DM.
The wizard applies your policy (backing up the previous one), scans the agent’s config against it, and offers one-key fixes for what it can repair automatically.
Everything below is also in aiguardian --help (and every subcommand answers --help itself). Commands print a clean report in the terminal; the interactive ones open a full-screen browser you leave with Esc.
| Command | What it does |
|---|---|
aiguardian | Same as aiguardian scan — the default. |
aiguardian scan [agent] | Scan an agent’s config for issues and fix them. Without an agent it opens the picker. |
aiguardian onboard | Launch (or re-run) the onboarding wizard. |
aiguardian status | One-screen overview: protection, alerts and plan at a glance. |
aiguardian audit | Interactive audit-log browser. |
aiguardian allowlist | Browse the allow rules you have saved. |
aiguardian mcp status | Print every MCP server on this machine and the policy action on each. |
aiguardian mcp review [agent|all] | Re-review MCP servers and update each server’s keep/remove action. |
aiguardian mcp login <server> | One-time browser sign-in to an MCP server that requires authorization. |
aiguardian mcp logout <server> | Forget the stored authorization for an MCP server. |
aiguardian skills [agent|all] | Re-review the skills installed for a protected agent. |
aiguardian agents | Change which AI agents are protected. |
aiguardian credmon | Manage the credential paths blocked from AI access. |
aiguardian notifications | Reconfigure the alert platform and DM target. |
aiguardian hook reinstall <agent> | Force-reinstall the guardian hook for an agent — recovers a stale or disabled hook. |
aiguardian feedback | Send feedback to Bitdefender from a short in-terminal form. |
aiguardian about | Product version and third-party license information. |
AI Guardian uses a small, consistent vocabulary everywhere — the wizard, the audit log, and alerts:
The action was checked and allowed to proceed.
The action went through but was flagged for your review.
The action was stopped before it ran.
For MCP servers, policy stores one of two standing decisions per server:
allowremoveaiguardian audit opens a calendar of everything AI Guardian checked — encrypted, local, and grouped the way you'd investigate it.
An allow rule is a saved exception: “this tool, on these files, is fine.” Rules are written where you make the decision — press a on an audit event, or allow a flagged skill or MCP server during a review — and are as narrow as that moment: a tool name, an MCP server, a file path or glob, the exact findings you looked at.
Pressing a on an event opens the rule builder: a checklist of exactly what that event touched. Tick the parts the exception should cover with Space — the preview spells out in plain language what the rule would allow — edit a file path with e or widen it to a glob preset with g, then save with Enter. Nothing is saved until you do.
aiguardian allowlist shows every rule in plain language, with how often it matched and when it last fired, so stale exceptions are easy to spot and remove.
When something needs your eyes — a blocked tool call, a flagged skill — AI Guardian can DM you on the chat platform you picked during onboarding. Alerts go to a private 1:1 conversation, never a group.
Change the platform or the DM target at any time with aiguardian notifications. The audit browser shows the same attention items at the top of its calendar, so nothing depends on the DM arriving.
Decisions are made locally. Skill scans and policy checks run on your Mac, and the audit log is stored encrypted on your machine.
During the BETA, anonymous reporting is on for every install — onboarding states it up front (p on that screen opens the privacy policy) rather than asking, and the build ships without an off switch. It covers protection decisions only: how often a tool call was blocked or a skill was flagged, and which scanners fired. It never includes prompt contents, file contents, credentials, or anything your agents processed.
Questions the docs don’t answer yet are exactly what the BETA is for — send them straight from your terminal with aiguardian feedback.
This site is built to be read by AI assistants, browsers, and agents. Structured, curated context is available at: