Gjallar(Ai-Agent-Firewall)

The description states that Gjallar is a policy and approval system for coding agents. It enforces rules on code changes made by AI agents, using mechanisms that operate outside the model to ensure compliance.

• For Claude Code, it uses a native PreToolUse hook.
• For Codex, it provides an MCP write gateway called policy_apply_patch.
• The system checks proposed writes before they are applied and logs all actions.
• It separates enforcement from guidance: rules are retrieved based on task and path for model awareness, but enforcement happens independently.

The product is described as a plugin or tool, not a standalone SaaS platform. It integrates with existing agent runtimes through hooks or gateways.

The description states: “Gjallar is a policy and approval system for coding agents such as Codex, Cursor, and Claude Code.”

The description states: “The Codex adapter is an MCP server, not a hook.”

The description states: “Every intercepted write is logged. Repeated violations can be grouped into new rule candidates, but a human still decides whether those candidates become active rules.”

The description states: “Gjallar also separates guidance from enforcement.”

The authors claim that most agent-skill libraries focus on giving agents more abilities, but say little about permissions or audit history. Gjallar positions itself as solving this gap by enforcing policies outside the model.

• The original inspiration came from a conversation about a friend’s skill library — the question raised was: “What stops the agents from doing something they shouldn’t?”
• The product evolved from placing rules in prompts (which failed) to a system that enforces rules independently of the agent.
• It emphasizes accountability and auditability over capability expansion.

The description states: “Most agent-skill libraries focus on giving agents more abilities, but say little about permissions, approvals, or audit history.”

The description states: “We therefore separated the system into two parts: Guidance helps the model make better decisions. Enforcement independently decides whether a write is allowed.”

The description states: “The model is never the security boundary.”

The target customer appears to be companies using AI coding agents, particularly those with security, compliance, or governance concerns.

• The system is designed for enterprise use cases where access control and auditability are critical.
• It targets developers or engineering teams who want to govern how agents interact with codebases.
• The product seems aimed at organizations that have already adopted or are considering adopting AI coding tools like Codex, Cursor, or Claude Code.

The description states: “For companies, the biggest question is often not ‘Can the agent write code?’ It is: What is the agent not allowed to change, and who approved those rules?”

The description states: “Gjallar is a policy and approval system for coding agents such as Codex, Cursor, and Claude Code.”

No evidence of pricing or business model is provided in the description.

Not evidenced.

The project includes:

• Integration with multiple agent runtimes (Claude Code, Codex).
• Use of MCP (Model Control Protocol) for Codex integration.
• A CLI command for unregistering workspaces.
• Policy enforcement via a gateway (policy_apply_patch) that checks writes before applying them.
• Rule lifecycle management: Observed → Candidate → Under review → Approved → Active.
• Deny rules require human approval and cannot become active automatically.
• Logging of all intercepted writes.
• Separation between guidance (for the model) and enforcement (outside the model).

The description states: “Claude Code uses a native PreToolUse hook to block unsafe writes.”

The description states: “Gjallar provides an MCP write gateway called policy_apply_patch.”

The description states: “Rules also have a lifecycle: Observed → Candidate → Under review → Approved → Active.”

The description states: “Every intercepted write is logged.”

The description states: “The model is never the security boundary.”

There is no evidence of traction or maturity beyond the hackathon submission.

• The project was built during a hackathon.
• No mention of customers, revenue, or usage data.
• The authors note that it stopped ten unsafe write attempts in testing — but this is not a measure of real-world adoption.
• It includes plans for future features (e.g., support for more runtimes), suggesting early-stage development.

Not evidenced.

The description does not provide information about competitors or the competitive landscape. It only mentions that governance tooling lags behind capability tooling in the agent space.

The description states: “Capability tooling — skills, MCP — is way out ahead of governance tooling right now.”

Not evidenced.

• No real-world usage or adoption: The product exists only as a hackathon submission with no evidence of deployment or customer feedback.
• Limited integration support: Only two agent runtimes are mentioned (Claude Code and Codex), and the Codex integration is described as new and experimental.
• High token overhead: Benchmarks show a 35% to 137% increase in token usage depending on task size, which could be a performance concern for users.
• Human bottleneck in rule management: The system requires human approval for deny rules and policy changes, which may slow down adoption or scalability.

The description states: “Our benchmarks found that the Codex gateway can increase token usage by roughly 35% to 137%.”

The description states: “Deny rules can never become active automatically. A named human must approve them.”

The description states: “The model is never the security boundary.”

1. Has Gjallar been tested or used in any real-world environments beyond the hackathon?
2. What are the specific use cases or industries where this tool would be most valuable?
3. How does it handle scalability and performance at scale, especially with token overhead?
4. Are there plans to support other agent platforms beyond Claude Code and Codex?
5. What is the current state of rule lifecycle management in terms of automation vs. human involvement?
6. How do you plan to monetize or commercialize this tool?