Features

1. Blocks dangerous actions before they happen

AI agents can now delete files, overwrite data, run shell commands, and click "Pay Now" in a browser. Praxis intercepts the action before it executes, not after, and runs it through a decision cascade:

• Principal resolution — every request carries an unforgeable identity: praxis:local (you) or agent:* (a specific AI tool). This can't be spoofed by the agent itself.
• Risk-tier classification — every action is scored from T0 (read) to T3 (destructive / secret-touching) using a deterministic keyword and phonetic cascade, backed by local embeddings for novel or cross-language phrasing the keyword list hasn't seen before.
• Policy matrix — principal × risk tier decides the verdict. T3 actions and unknown callers are hard-deny floors that are never configurable, no matter how permissive your settings are.
• Fail-closed executor — kill-switch check → policy → approval → dispatch. If anything in that chain is uncertain, the default is to block, never to allow.

Destructive operations are also trash-first: a delete never immediately destroys data. It's moved to a recoverable trash location before the real removal would occur, so a wrong verdict is still reversible.

2. Refuses your secrets, categorically

SSH keys, cloud credentials (AWS/GCP/Azure), browser keychains, .env files, and API tokens are treated as T3 — secret-touching, the highest risk tier. This isn't a per-agent setting you can loosen: Praxis refuses to hand these to an AI agent regardless of how the request is phrased, because the matcher checks the actual action and path, not just the surface wording of the prompt.

3. A tamper-proof audit trail

Every decision Praxis makes — allowed, blocked, or escalated for your approval — is written to an append-only evidence log. Each record is SHA-256 hash-chained to the one before it, the same structure used in tamper-evident logging systems: if any past entry is edited or deleted, every hash after it breaks, so tampering is mathematically detectable, not just "logged and trusted."

This means you can always answer, with proof: what did this AI agent actually do on my machine, and when?

4. Works fully offline

Praxis doesn't require a network connection or a cloud account to function. Risk classification runs on a local embedding model, policy decisions are evaluated on-device, and when you want natural-language file search or questions answered without internet access, Praxis can serve a local model through Ollama. Nothing about the guardrail itself depends on a server we operate — because there isn't one in the free edition.

5. Finds anything, fast

"Find my passport scan" works even when the file is named IMG_4821_final_v2.pdf. Praxis does fuzzy, fast local search across your disk — filename and content — with no upload to any cloud service. Search results respect the same guardrail: an agent searching on your behalf still can't read something it isn't allowed to read.

6. You're always in control

Trust is per-tool and reversible. Enable or disable Praxis for each AI client (ChatGPT/Codex, Claude Desktop, Cursor, and others) independently. A single panic button revokes every active permission instantly if something looks wrong. Policy presets — Paranoid, Balanced, Permissive — give you a starting posture, and every cell of the principal × risk-tier matrix can be tuned beyond that, except the hard-deny floors.

7. Interception today, and where it's headed

Today, Praxis intercepts at the MCP layer — the protocol most AI tools use to call local tools — plus a browser-action wrapper for things like checkout buttons. That's a real interception point as long as the agent goes through the offered tool. The roadmap item is OS-level enforcement (macOS EndpointSecurity / Linux eBPF-LSM), which gates the actual syscall rather than the tool call, so interception holds even if an agent tries to route around the MCP tool with its own shell access. See the interactive walkthrough for a live comparison of which interception model catches which bypass attempt.