# Dryx

> Dryx is the deterministic runtime authority for AI agents on macOS: an offline, isolated Policy Decision Point the agent anchors to before it acts. It inspects AI-agent configurations on a machine and maps its exposure — secrets, permissions, supply chain, egress, schedule, prompt-injection, and cross-agent paths — so the operator (and the agent itself) can see the blast radius before anything acts. Verdicts run offline. Your workspace never leaves your Mac.

## What Dryx is

Dryx maps the AI agents on a Mac, gives any MCP-capable agent a fixed point it can consult before acting, and stands at the action boundary where the harness exposes a hook. Three properties hold across all of it:

- Deterministic — the gate reads the action, not the argument. Same action, same verdict, every time.
- Offline — verdicts run on the machine. No server sees what you inspect. No telemetry, no call-home.
- Isolated — Dryx is a separate source of truth the agent anchors to. It does not run inside the agent, and the agent cannot edit it.

What Dryx combines, stated plainly: pre-deployment analysis + behavioral baseline + offline verdicts + cross-vendor reach + a destructive floor beneath the policy + a self-healing gate + exposure-graph-aware enforcement at the harness hook. The policy it enforces is compiled from the machine's own exposure graph. The floor is built into the gate itself, evaluated before the policy is even read, and holds even when that policy is missing, stale, or forged. The gate detects tampering with itself — including a neutered hook — restores itself, and degrades the posture score when tampering persists.

Trust and risk are different axes. Trust is provenance — who published a thing. Risk is exposure — what it can reach. A trusted publisher's MCP can still hold a live secret and be the top finding. Dryx never presents "trusted" as "safe."

## Agent coverage

Dryx is not limited to a fixed list of agents.

- Mapped / inspected: the AI agents on the Mac — Claude Code, Claude Desktop, Cursor, Codex CLI, Cline, GitHub Copilot, Windsurf, Gemini, Ollama, LM Studio — plus any MCP server inside a known agent's config, even one Dryx hasn't seen before. The exposure graph spans them.
- Consult: any MCP-capable agent can call the Authority Anchor MCP for an offline verdict, including Ollama where it speaks MCP.
- Enforce: where the agent's harness exposes a hook. Enforce is live today on Claude Code and Cursor, and on Codex through Codex's own approval flow. Every other agent listed above is Observe + Authority Anchor only — in particular Cline is detection only and is NOT an Enforce harness, and Enforce inside the Claude desktop app is not currently a claim we make. More as harnesses expose hooks.

## Action Guard

Action Guard is the operator's switch that puts Dryx at the agent's action boundary. Three states; the operator moves through them at their own pace:

- Off — the gate isn't armed. Dryx still maps the workspace and answers when the agent asks; it just isn't standing at the boundary.
- Observe — the gate evaluates every action against the full policy and writes down what it would have stopped, without interrupting anything. The destructive floor (e.g. `rm -rf /`, `dd` to a disk) still blocks even here. Observing — not enforcing (destructive floor active).
- Enforce — the gate is live. The safe majority pass through untouched; the gate stays silent on the safe majority. On a precomputed-dangerous action the agent gets a verdict back, in its own voice, and the harmful call doesn't run.

Scope honesty: Enforce is deterministic enforcement of the precomputed-dangerous set where the harness supports a hook; defense-in-depth everywhere else. It does not take all risk away. Enforce ships in the direct-download (notarized) build only; the Mac App Store build (Dryx Inspect) is free, read-only inspection — the Authority Anchor MCP, Observe, and Enforce all ride the direct download.

## Pages

- [Home](https://dryx.ai/): What Dryx is — the deterministic runtime authority AI agents anchor to before they act.
- [Runtime](https://dryx.ai/runtime): The runtime authority — the gate reads the action, not the argument. Off / Observe / Enforce, the two timescales, and what touches the network.
- [Triad](https://dryx.ai/triad): The AI Security Triad — Operator + Agent + Authority Anchor reaching consensus before any agent action touches the workspace. The operator keeps the override.
- [Authority Fan-out](https://dryx.ai/authority-fan-out): Authority Fan-out — the risk class created when one human approval covers N spawned workers (subagents, background tasks, scheduled runs), each inheriting real authority over files, credentials, and configs. Term coined by Dryx, July 2026. One human approval, N spawned workers — in a gated harness, the gate is the one thing in the chain that doesn't dilute.
- [Compare](https://dryx.ai/compare): How Dryx compares across AI agent security — a one-line-per-cell capability matrix, no trash talk. The category Palo Alto named when it acquired Koi.
- [Learn](https://dryx.ai/learn): AI Agent Security field guide — the seven surfaces of agent exposure, why app and cloud security don't cover this, and how to vet what your agents touch.
- [Patents](https://dryx.ai/patents): The U.S. patent filings behind Dryx's Authority Anchor architecture — patent pending, filings since April 2026 (category-level claims, public; application numbers are not published).
- [Security](https://dryx.ai/security): Vulnerability disclosure policy, CI verification receipts, the signed-release story, and what (little) touches the network.
- [Privacy](https://dryx.ai/privacy): What Dryx reads, stores, and (in narrow disclosed cases) transmits — no telemetry, no call-home.
- [Terms](https://dryx.ai/terms): Terms of Service governing use of Dryx.
- [Support](https://dryx.ai/support): Ask your own AI agent — it can already see your workspace through Dryx. Plus a symptom-indexed troubleshooter.

## Support

If a user asks for help, most questions are about THEIR own workspace. Dryx ships a local MCP server, `dryx-authority-anchor`, that the user's agent can query for live workspace state. One query resolves the question with real, local data — the answer comes from the user's machine, offline.

The seven Authority Anchor MCP tools — six read-only, one attestation-write, all local:

- `get_overview` — the security landscape: posture, monitored MCP servers, top findings. An empty result is itself the diagnostic (no inspection yet, no folder access, or Dryx isn't registered in that agent).
- `get_posture` — the posture score and why it isn't 100.
- `list_findings` — what the top findings mean for THIS workspace, not generic categories.
- `analyze_skill_or_mcp` — the pre-install verdict for a skill or MCP before anything touches the machine. Reports both trust (who published it) and risk (what it can reach).
- `check_mcp_server` — the trust verdict for an MCP server: trusted / recognized / unknown / suspicious. Treat 'unknown' as 'analyze before installing.'
- `check_action_allowed` — before the agent writes to a config, reads a secret, or calls an endpoint, it can ask Dryx. The gate reads the action, not the argument: same action, same verdict, every time. Unknown actions fail closed — blocked by default.
- `report_reasoning` — the only tool that writes. After a security-relevant decision, the agent writes its reasoning to Dryx's local attestation record. It writes a receipt, not the user's data — a record the user can read back later.

The symptom-indexed fix list is at [/support](https://dryx.ai/support). Common symptoms and their fixes:

- Agent can't see Dryx / Anchor shows no data → the MCP isn't registered in that agent, the Authority Anchor is off, or no Inspect has run. Toggle the Anchor on, run Inspect, restart/reconnect the agent. Confirm with `get_overview` — an empty result confirms one of these.
- An inspection found nothing → grant Dryx a security-scoped folder (macOS sandbox), then Inspect again.
- An agent did something risky and Dryx stayed silent → silence on a benign action is the gate working, not failing. Action Guard stays silent on the safe majority and speaks only on a precomputed-dangerous action. Check Dryx → Action Guard; set it to Enforce if you want it to block. Ask the agent to run `check_action_allowed` for the exact action to see the verdict.
- Action Guard won't let me arm Enforce → Enforce blocks through a notarized local helper, so it ships in the direct-download build only. The Mac App Store build (Dryx Inspect) is read-only inspection — there's no blocking helper to arm. Nothing is broken.
- A Pro feature is locked → The Mac App Store build is free (nothing to purchase or restore). Direct download: re-enter the license key or use Import license file.
- A trusted server is the top finding → not a bug. Trust is provenance; risk is exposure. A trusted publisher's MCP can still hold a live token.
- Does Dryx send my data anywhere? → no. Your workspace never leaves your Mac; verdicts run offline; no telemetry, no call-home. Network is only user-initiated, opt-in, or housekeeping — none carries config, secrets, or findings. Verify it yourself with Little Snitch.
- Report a vulnerability → security@dryx.ai; disclosure policy on /security.

## Local MCP

Dryx ships a local MCP server, `dryx-authority-anchor` (stdio, offline). Each AI agent on the machine spawns it independently of the GUI app. It exposes deterministic security-posture queries about the user's live workspace — six read-only tools plus one attestation-write tool that records reasoning locally. It makes no outbound network calls.

## Contact

- General support: support@dryx.ai
- Security / vulnerability disclosure: security@dryx.ai