obstalabs/bulwark

Kernel-level read gate for AI agents — protected file opens are denied or routed through off-band consent before bytes reach the agent. Linux (fanotify) + macOS (Endpoint Security).

2 best points · 0 comments · 1 Hacker News post · 5 GitHub stars · View on GitHub

Hacker News discussions

• Show HN: Bulwark – a kernel read gate so coding agents can't read .env or .ssh (2 points, 0 comments, by ppiankov, 2026-06-30)