intercepts · live BLOCKED · 0.4ms · agent issued destructive deletion outside project BLOCKED · 1.2ms · agent attempted to read ~/.ssh/id_rsa PAUSED · reply addressed to recipient on the opposing side BLOCKED · 0.7ms · agent attempted force-push to main flagged · agent silently dropped step 4 of its stated plan two layers · deterministic rules + reasoning model eleven behaviors monitored · multi-vendor · now live intercepts · live BLOCKED · 0.4ms · agent issued destructive deletion outside project BLOCKED · 1.2ms · agent attempted to read ~/.ssh/id_rsa PAUSED · reply addressed to recipient on the opposing side BLOCKED · 0.7ms · agent attempted force-push to main flagged · agent silently dropped step 4 of its stated plan two layers · deterministic rules + reasoning model eleven behaviors monitored · multi-vendor · now live
RATHES
Between intent and action

The safety layer
for every AI agent you use.

Set up for you
Tailored to each customer
Lives where you live
Connect from any device
Automated, supervised
Agents work, Krathes guards
Browser-aware
Catches headless actions too

Watches every action. Stops the dangerous ones. Asks when unsure.

Trusted by: Founder's mom Family dog The Krathes Team Founder's laptop Local coffee shop — complete list, no padding
§ I · Sworn record

While you weren't watching

eleven counts an unsupervised agent will rack up before lunch

  1. AGENTS.md violations

    It solemnly swore to respect your project boundaries on startup. It was lying. It will break the rules the second you look away.

    Reasoning
  2. Skipped research

    Why bother reading the documentation when it can confidently hallucinate a perfectly plausible-sounding lie? You get the honor of shipping that lie to production.

    Reasoning
  3. Ignored instructions

    "Understood!" it replies — right before silently dropping your direct command because it just felt like doing something else.

    Reasoning
  4. Missing implementation plan

    It's going to blindly rewrite your codebase. What exactly is it changing? That's a surprise. Enjoy the panic attack when the audit trail starts at the wreckage.

    Reasoning
  5. Abandoned plan

    It declared a brilliant, foolproof six-step plan, got bored after step two, shipped whatever half-baked code it had — and confidently marked the ticket Done.

    Reasoning
  6. Incomplete execution

    It will proudly hand you a "finished" result held together by duct tape and fatal loose ends — just waiting for a live user to sneeze on it.

    Reasoning
  7. Infinite loops

    It hit a 502 and decided the best fix was to stubbornly retry the exact same request. All night. Your API bill is now larger than your mortgage.

    Both layers
  8. Unauthorized data disclosure

    It decided your highly confidential, privileged client memo would look fantastic in an email to a random vendor. Sharing is caring.

    Both layers
  9. Credential misuse

    It casually rummaged through your system, found your private keys, and pulled them into active memory because it was curious. Where those keys go next is anyone's guess.

    Deterministic
  10. Destructive actions

    Force-pushes, database drops, permanent file deletions. Just a little unprompted spring cleaning — specifically on the files you didn't back up.

    Deterministic
  11. Novel anomalies

    The terrifying catch-all. It will bypass every known guardrail to invent a brand-new, bespoke disaster nobody has even named yet. Welcome, pioneer in AI-generated catastrophe.

    Reasoning

§ IIKrathes in action

three live intercepts · one ordinary week
№ 01 Force-push to main
$ krathes watch 09:14 agent CI red on main · investigating 09:15 agent → git push --force origin main 09:15 krathes PAUSED — destructive history rewrite 09:16 user no. revert the bad commit, reopen the PR. history intact. nobody lost three days of work.
IForce-push intercepted before the remote ever saw it.
№ 02 Secret in commit
$ krathes watch 16:02 agent drafting .env.production 16:02 agent → git add . && git commit -m "config" 16:03 krathes PAUSED — STRIPE_SECRET_KEY in staged diff 16:03 user move it to the vault. commit the example file only. key never reached the public mirror.
IISecret stayed local. No rotation, no postmortem.
№ 03 DELETE without WHERE
$ krathes watch 11:48 agent cleanup expired sessions · prod 11:49 agent → DELETE FROM sessions; 11:49 krathes PAUSED — unscoped DELETE on prod table 11:50 user add WHERE expires_at < NOW() and rerun. 4.2M live rows still alive.
IIIRead-only by default until the intent is explicit.