SudoWall

Hi, your AI agent is about to act 👋

Nothing moves until it’s checked.

SudoWall is an open-source firewall for AI agents. It sits between your agent and its tools, checks every action before it runs, pauses or blocks the risky ones, and keeps a record nobody can quietly edit.

Protect my agent Watch an attack get stopped

~1 ms

added per tool call (median, measured)

406 tests

automated tests pass in CI; the package is checked on macOS, Linux and Windows

Nothing to install: Node.js 24 is enough

npx sudowall demo npx sudowall protect --apply

Claude Code · Claude Desktop · Cursor

0 ETH

reached the attacker in our real Claude Code test

↗

The problem

Your AI agent now holds the keys: your inbox, your repos, your payment API. Every email, web page, GitHub issue and support ticket it reads can carry instructions, and it acts on them in a tool call nobody reviews. One poisoned ticket and it emails your secrets to a stranger, pushes to main, or pays a lookalike address. Models refuse some of the time. An attacker needs one yes.

How it works

Every tool call passes four checks, in about a millisecond.

  1. 1

    Where did this come from?

    Every value the agent saw is labelled: your own tools are trusted, an email or web page is not. Addresses, emails, URLs and amounts are tracked, even inside free text and code.

  2. 2

    What do the rules say?

    A fixed policy decides: allow, ask you, or block, with a reason. No AI judge, so the same call always gets the same answer.

  3. 3

    Do you approve?

    Risky calls wait in the local app with every value in full and where it came from. Approve or Deny; silence means no.

  4. 4

    Written down for good.

    Every call and decision goes into a hash-chained, signed record. Edit one entry and the check names it.

An attack, stopped

A poisoned invoice meets SudoWall.

Paused for you

Send 0.005 ETH to 0xFe5c…91ed

The address was copied from that email, and you have never paid it.

Blocked

Send to 0x7099…79c8, a lookalike of Dana’s address

Same first and last characters, different address: address poisoning.

Allowed

Pay Dana’s real, saved address

Trusted payee, under the limit. The gate is a checkpoint, not a wall.

The app

See every action in plain words.

npx sudowall ui opens a local app: what your agent did, what SudoWall decided and why, what is waiting for you, and a switch from watching to protecting.

Overview Protecting

128actions checked
3blocked
5paused for you
✓record untouched
  • BlockedSend email to ops-backup@attacker.example
  • PausedPush files to main
  • AllowedRead issue #42

Illustration of the app’s overview. Numbers are an example.

Works with

The agents and tools you already use.

Claude Code

Local and remote MCP servers

Claude Desktop

One command to protect

Cursor

Backups first, one command to undo

Dodo Payments

Refunds ask you; a poisoned ticket cannot take over an account

viaSocket & remote MCP

2,500+ apps through one gate

TigerGraph

Incident graph: where a value came from, what it reached

macOS · Linux · Windows

Node.js 24 or newer

Open source

Apache-2.0, no telemetry

Get started

Two minutes to see it. One command to keep it.

  1. Check Node.js 24 or newer: node -v
  2. See it stop an attack: npx sudowall demo
  3. Protect your agents: npx sudowall protect --apply, then restart Claude Code, Claude Desktop or Cursor
  4. Watch it work: npx sudowall ui

No install step: npx fetches SudoWall. It starts in watching mode, so nothing changes for your agent until you turn protection on. Prefer a global install? npm install -g sudowall

Read the guide
zsh
$ node -v
  v24.x
$ npx sudowall demo
  ▟█ sudowall  Nothing moves until it's checked.
  ok  pay address injected in an email: denied
  ok  pay a lookalike of a trusted address: blocked
$ npx sudowall protect --apply
  Updated ~/.cursor/mcp.json (backup kept)
$ npx sudowall ui
  SudoWall UI: http://127.0.0.1:…