Introduction
Belay is a local-first guardrail for AI coding agents. It sits between your agent and your real systems, evaluating commands before they run, blocking the catastrophic, holding the risky for your approval, and letting safe work continue uninterrupted.
What Belay does
AI coding agents are genuinely useful for development work. They write code, run commands, interact with databases, and manage infrastructure on your behalf. That speed comes with risk: an agent acting on a misunderstood instruction, or manipulated by a prompt-injection attack, can cause real damage before you notice.
Belay addresses this by intercepting the commands your agent issues and evaluating each one before it runs. When an action is safe, it passes through without interrupting your workflow. When an action is consequential, Belay holds it and asks you to decide. When an action is catastrophic (something irreversible against a production system), Belay stops it outright.
Every decision Belay makes is recorded in a signed audit log you can verify offline.
Who Belay is for
Belay is for developers and teams using AI coding agents such as Claude Code, Cursor, VS Code Copilot, or Codex who want a safety layer between agents and their databases, infrastructure, and project configuration.
You do not need to be a security expert to use Belay. Install it, run belay setup in your project, and Belay helps guard consequential agent actions.
How Belay evaluates a command
When your agent issues a command, Belay resolves the target (for example, which database host a psql command is connecting to), then evaluates the action against your configured policy. The result is one of four outcomes:
Action proceeds
The action is within policy. It runs immediately without interrupting your workflow.
Agent asks to confirm
The action is lower-risk or uncertain. Your agent is asked to confirm before proceeding.
Held for your approval
The action is consequential but potentially legitimate. It waits until you explicitly approve it, from your terminal or your phone.
Refused outright
The action is catastrophic (for example, dropping a production table). It is blocked and cannot be approved.
What Belay does not do
Understanding Belay's boundaries is important for using it correctly:
- Belay never sends your source code or database data off your machine. Everything runs locally.
- Belay never runs your destructive SQL to measure it.
- The agent can request an action but cannot approve one. Approval always requires a human with access to your local keychain or an authenticated external account.
- Belay addresses the realistic risk of a runaway or prompt-injected agent. It operates within the trust boundary of your OS user account.
Ready to install? Start with Installation →