KavachOS is a behavioral governance layer designed to enforce strict operational boundaries for AI agents, particularly those running on developer laptops and maritime vessel systems. Prompted by real-world attacks exploiting the elevated privileges of AI coding tools, KavachOS mediates agent interactions with the operating system to prevent unauthorized actions and reduce the risk of credential theft and system compromise.
The platform implements a syscall mediation layer, intercepting every OS call an agent attempts and checking it against an allowlist before execution. It features an exec allowlist to restrict which binaries agents can spawn, an egress firewall that blocks outbound network connections unless explicitly permitted, and a sandboxed runtime that isolates the agent's working context, denying access to sensitive host filesystem paths by default. For maritime deployments, KavachOS incorporates eight domain-specific behavioral signatures (MAR-001 to MAR-008) to detect and block injection attacks targeting protocols like Modbus, NMEA, and AIS, addressing threats unique to ship-side AI agents.
KavachOS is built to operate at the ptrace and seccomp layers rather than the application layer, providing hard enforcement gates that agents cannot bypass without explicit permission. It is delivered as a TypeScript/Bun package and includes an n8n workflow node, with references to deployment in environments such as developer laptops and vessel edge systems. 0.
By enforcing behavioral boundaries at the OS level, KavachOS directly addresses requirements for human oversight and predictable agent actions as outlined in regulatory frameworks like the EU AI Act Article 14. When paired with complementary layers for budget governance and cryptographic attestation, it forms part of a comprehensive stack for AI agent safety and compliance.
In the LLM eval & observability space, KavachOS takes a focused approach. It focuses on ensuring safe and governed execution of CrewAI agents with budget and policy controls. It is built as an open-source project for AI agent developers. KavachOS is open source under the AGPL-3.0 license. It runs on the web, the command line, and API.
Behind KavachOS is rocketlang, and the product first shipped in 2026. Development happens publicly on GitHub with 186 commits in the last 90 days. PulseGate's similarity index finds few close equivalents — KavachOS occupies a relatively distinct niche. Key capabilities include DAN gate, budget guard, and pre-execution governance.
Latest indexed changes and source events
xshieldai.com discovered by the PulseGate indexer
Other apps tracked under the same category.
