Golem Defender changelog

https://golem.team/llms.txt

− Golem exposes two capabilities to agents over MCP, discoverable via the Agentic Resource Discovery (ARD) catalog and authorized through standard OAuth (scoped, short-lived, revocable tokens):− - Golem Safety: an action-time verdict on whether a URL, domain or IP is safe to connect to, from aggregated threat intelligence. With the Golem agent installed, it is checked on every call's target before the call runs. Over MCP, `check_indicator` needs `intel.lookup`, which a person approves in the device flow and a trial never gets, because each check sends the indicator to outside services and spends the workspace's lookup quota.+ ### Free, open-source tools, with no account+ [golem-team-shield](https://github.com/GolemTeam/golem-team-shield) (Apache-2.0) holds two programs that need no account and send nothing anywhere. `golem-check` grades the setup of Claude Code, Cursor, Codex, Gemini CLI, Devin and the VS Code family (run modes, permissions, MCP servers, skills, hooks, stored secrets and plugin sources) and can check a repository in CI with SARIF output. `golem-exec` puts every shell command Claude Code, Codex, Gemini CLI and Cursor run in a kernel jail, set up + Golem exposes three capabilities to agents over MCP, discoverable via the Agentic Resource Discovery (ARD) catalog and authorized through standard OAuth (scoped, short-lived, revocable tokens):+ - Golem Safety: an action-time verdict on whether a URL, domain or IP is safe to connect to, from aggregated threat intelligence. With the Golem agent installed, it is checked on every call's target before the call runs. Over MCP (`/intel`), `check_indicator` gives the verdict and `lookup_host` a host's DNS and registration record without contacting the host. Both need `intel.lookup`, which a person approves in the device flow and a trial never gets, because each lookup sends the indicator to ou+ - Golem Defender: the tools a defender agent uses on a coding-agent fleet (`/defender`): every ledger read, plus filing a finding as a typed indicator and attaching a detection rule that starts in shadow. Golem's own investigators use it, and a team's own defender agents can, with the same scopes.+ - [Free tools](https://docs.golem.team/free-tools.md): `golem-check` and `golem-exec` from the open-source golem-team-shield, the Golem agent with no account, and what a workspace adds.

https://golem.team/llms.txt

− - **Somewhere to put the dangerous work.** A page linked from an issue, a repository you did not write, a downloaded file: `sandbox_browse`, `sandbox_run` and `sandbox_open` (macOS) hand it to a locked-down child agent in a throwaway VM, with no credentials and network only to the hosts you allow. You get the answer or a patch back, plus every attempt it made to get out. The content never gets near your user's keys.− - **Where it works.** macOS and Linux (`install.sh`), and Windows (`install.ps1`). In Claude Code and Cursor alike, a blocked call is refused before it runs; a held call becomes the client's own approval prompt where it has one. The shell jail is for Claude Code (on Windows it needs Git for Windows), and the sandbox needs Apple silicon with macOS 26 or later. Across a fleet, IT pushes the same installer through Jamf, Intune or Kandji, run in the logged-in user's context (on Windows, `install.ps1− - **What it changes.** It installs the `golem` binary and a per-user background service (launchd on macOS, systemd on Linux). It adds `golem-*` MCP entries and hooks to the agent clients it finds (Claude Code, Cursor, Codex and others) and leaves every other entry alone. On Apple silicon with macOS 26 or later it also sets up the sandbox, which asks for your user's password once.+ - **Somewhere to put the dangerous work.** A page linked from an issue, a repository you did not write, a downloaded file: `sandbox_browse`, `sandbox_run` and `sandbox_open` (macOS, and Linux with KVM) hand it to a locked-down child agent in a throwaway VM, with no credentials and network only to the hosts you allow. You get the answer or a patch back, plus every attempt it made to get out. The content never gets near your user's keys.+ - **Where it works.** macOS and Linux (`install.sh`), and Windows (`install.ps1`). In Claude Code and Cursor alike, a blocked call is refused before it runs; a held call becomes the client's own approval prompt where it has one. The shell jail is for Claude Code (on Windows it needs Git for Windows), and the sandbox needs Apple silicon with macOS 26 or later, or Linux with KVM. Across a fleet, IT pushes the same installer through Jamf, Intune or Kandji, run in the logged-in user's context (on Wi+ - **What it changes.** It installs the `golem` binary and a per-user background service (launchd on macOS, systemd on Linux). It adds `golem-*` MCP entries and hooks to the agent clients it finds (Claude Code, Cursor, Codex and others) and leaves every other entry alone. On Apple silicon with macOS 26 or later it also sets up the sandbox, which asks for your user's password once; on Linux with KVM it downloads the sandbox's VM images without asking.