AIDR

AI Agent Detection & Response

A detection layer for the tool calls your AI coding agents make.

Singularity AIDR checks shell commands, file operations, web requests and MCP calls against 519 rules and your policy, and blocks or flags risky ones. Detection runs on the developer machine. It is offered today as a 14-day, 1-agent evaluation.

Apply for the 14-day evaluationSee coverage and limits

Detection pipeline

  1. Tool call received
    Shell, file, web and MCP calls the host routes through its hook
  2. Extract artifacts
    Commands, URLs, file paths, package names, content
  3. Allowlist and cache
    Exact-artifact allowlist and recent verdicts
  4. Run rules
    519 YAML threat rules in 31 files, plus policy
  5. Optional reputation checks
    URL, file hash and package checks, only when enabled
  6. Decision engine
    Merge signals; deny wins over ask, ask wins over allow
  7. Verdict
    Allow, ask (block pending human approval) or deny
Where this stands. AIDR is in controlled evaluation and no release has been cut. Real-host acceptance covers one host version on Linux x64 for four connectors and none for Cursor or VS Code, there is no independent security assessment or certification yet, and there is no SLA. The trust center lists what is verified and what is open.

How it works

Four signals, one verdict

Each tool call passes through independent checks. They return allow, ask or deny, and the decision engine merges them with deny over ask over allow.

Local rules

519 data-driven YAML rules match dangerous commands, sensitive file paths, credential exposure, obfuscation and prompt-injection patterns. They run on the developer machine.

Policy

Filesystem, network, MCP and tool rules from local configuration or a signed policy published from the dashboard.

Package and plugin checks

Package-install commands are checked against registry metadata, age heuristics and offline intel. Installed plugins are scanned at session start.

Optional reputation

URL, file-hash and package reputation lookups when enabled. They need a configured first-party endpoint and an unavailable lookup is never reported as clean.

Capabilities

What the product does

Tool-call inspection

Shell commands, file reads and writes, web fetches and MCP calls, for the tools each host routes through its hook.

Block pending approval

A call that needs a human decision is blocked. No approval tool is exposed to the agent, so an injected prompt cannot approve its own block.

Device authorization

Enrollment uses short-lived, single-use codes that a signed-in user approves in the browser.

Incident correlation

Repeated denials and suspicious retries are grouped into cases with owner, status and evidence.

Dashboard and policy rollout

Registered agents, events, incidents, policy publication with optional two-person approval, and drift tracking.

Signed webhook export

Send deny and critical events to a webhook you control, with delivery failures tracked and replayable.

Output inspection

Tool output can be checked for leaked credentials and injection after the tool runs. This is a post-execution step and cannot undo the action.

MCP and plugin inventory

Local MCP server configurations and installed plugins are discovered and checked at session start.

Credential scrub

Bearer tokens, API keys and secret URL parameters are removed from events before they leave the machine.

Enterprise options such as SSO, SCIM, SIEM export, audit export and self-hosting are labelled as implemented, partial or roadmap on the enterprise page.

Rule coverage

519 rules in 31 YAML files

All detection logic is data: rules are YAML files that can be reviewed and updated independently of the code. A rule count is not an effectiveness measure; independent false-positive and evasion measurements are still open.

  • Remote code execution
    curl piped to a shell, reverse shells
  • Credential theft
    SSH keys, .env files, cloud credentials
  • Supply-chain attacks
    Typosquatted packages, dependency confusion
  • Prompt injection
    Direct and indirect injection, system prompt extraction
  • Data exfiltration
    Unexpected network calls and uploads
  • Destructive operations
    Recursive deletes, disk wipes
  • Persistence
    Cron, systemd, launch agents, shell startup files
  • Obfuscation
    Encoded payloads and hidden commands
  • Plugin tampering
    Malicious or modified plugins and extensions
  • Privilege escalation
    sudo abuse, setuid, token theft

Connectors

Six connectors in the intended scope

Each connector uses the integration point its host offers. Claude Code, Codex CLI, OpenClaw and OpenCode each have a real-host acceptance record for one host version on Linux x64 (development build). Cursor and VS Code are preview, with no real-host acceptance evidence yet. Windows, macOS and arm64 are target platforms without real-host acceptance, and no macOS installer is offered. No release has been cut, so no connector is yet described as a supported configuration.

Claude Code

Pre-tool-call hook (PreToolUse), post-tool-output inspection (PostToolUse) and a session-start plugin scan.

Tested on one host version: Claude Code 2.1.296, linux/x64, development build, 2026-10-11. Other versions and platforms are unverified.

Install steps and limits

Cursor

Managed pre-tool-use hook installed by the extension.

Preview: no real-host acceptance evidence yet.

Install steps and limits

VS Code

Managed agent hook installed by the extension.

Preview: no real-host acceptance evidence yet.

Install steps and limits

OpenClaw

In-process plugin: before_tool_call, with post-execution output and reply inspection.

Tested on one host version: OpenClaw 2026.9.6, linux/x64, development build, 2026-10-11. Other versions and platforms are unverified.

Install steps and limits

OpenCode

Plugin hooks: tool.execute.before and tool.execute.after.

Tested on one host version: OpenCode 1.18.32, linux/x64, development build, 2026-10-11. Other versions and platforms are unverified.

Install steps and limits

Codex CLI

Native PreToolUse command hook, with an optional UserPromptSubmit prompt check.

Tested on one host version: codex-cli 0.141.0, linux/x64, development build, 2026-10-11. Other versions and platforms are unverified.

Install steps and limits

Security and privacy

What stays local and what does not

Local by default

Rule and policy evaluation run on the device. Local detection does not upload source files or full prompts.

Optional outbound paths

Reputation lookups, version checks, deep scans, alert webhooks and managed telemetry each send specific data and can be disabled. They are listed in the privacy draft.

Failure handling

Failure policy differs by layer: detection signals are skipped on error, connector entry points block, security controls fail closed.

Evaluation and pricing

Start with a 14-day evaluation

The evaluation offer is 14 days and 1 protected agent, by application and subject to approval. It ends after the 14 days unless an order is agreed in writing. Pricing is set by approved order. There is no public price list, and nothing on this site is a quote.

Apply for the evaluationEvaluation and pricingContact sales

FAQ

Frequently asked questions

What is AIDR?

Singularity AIDR (AI Agent Detection & Response) checks the tool calls AI coding agents make, such as shell commands, file operations and web requests, against rules and policy before they run, and blocks or flags risky ones.

Does it need a cloud account?

No. Detection and policy run locally and a fresh install enforces without an account. The managed dashboard is an optional layer for fleets. Optional reputation lookups, version checks and managed telemetry are separate outbound paths that can be turned off.

Which agents does it support?

Six connectors are in the intended first-release scope: Claude Code, Codex CLI, Cursor, VS Code, OpenClaw and OpenCode. Each connector has documented limits. Claude Code, Codex CLI, OpenClaw and OpenCode each have a real-host acceptance record for one host version on Linux x64 (development build). Cursor and VS Code are preview, with no real-host acceptance evidence yet. Windows, macOS and arm64 are target platforms without real-host acceptance, and no macOS installer is offered. No release has been cut, so no connector is yet described as a supported configuration. See the install page.

Can an agent get around it?

Yes, in some cases. AIDR only sees actions that pass through the host's hook. A disabled hook, a separate terminal, or direct network access that never becomes a tool call is not seen. The install page lists the known limits for each connector.

Can it break my agent?

A failing detection signal is skipped and logged. Connector entry points return a block on an internal error rather than silently allowing the call, so a fault can stop an agent action. Blocks pending approval stay blocked until an operator approves them.

How is data handled?

Detection runs on the device and does not upload source files or full prompts. Optional features send specific data, such as URLs, package names or file hashes, and managed telemetry defaults to hashes. The privacy page is a draft pending legal review and lists each path.

What does it cost?

The evaluation offer is 14 days and 1 protected agent, by application and subject to approval. It ends after the 14 days unless an order is agreed in writing. Pricing is set by approved order. There is no public price list, and nothing on this site is a quote.

Is it certified?

No. There is no SOC 2 report, ISO 27001 certificate or independent penetration test yet. The trust center lists what is open.