The governed AI coding agent.

Aerthos is an AI coding agent with a policy engine at the tool boundary. Every action is gated and audited, and writes are checkpointed so you can roll them back. It runs in your terminal, and your code stays on your machine.

Download Sign in

internal beta · free · macOS, Windows, Linux

aerthos gate G1 · Shift+Tab cycles posture

› read src/billing/invoice.rsG0 ok

› run cargo test -p billingG0 ok

118 passed · 0 failed

› edit src/billing/invoice.rsG1 ok

checkpoint 9f27c1 · shadow store · rollback ready

› run git push --force origin mainG2 review

held: destructive action needs human approval

approve once? [y/N] y

approval signed · ed25519 · single use

ledger: appended · hash chain verified

›

A session in the operator console. The gate holds a force-push until a human signs off.

Model output is never authority.

Every AI coding tool today asks for the same thing: blind trust. The model gets your shell, your files, your secrets, and you hope it behaves.

Aerthos is built on the opposite thesis. Model output is a proposal, not a command. A policy engine sits between the model and your system and decides what actually runs. Safe reads proceed. Reversible writes are checkpointed first. Destructive actions stop and wait for you.

Governance here is not an enterprise tier or a plugin. It is the default build. Every prompt, tool call, policy decision, human approval, patch, and rollback leaves a tamper-evident trail.

Agents powerful enough to do real work, governed enough to be trusted with it.

How it works

Task in

You hand the agent a task in your terminal. It plans, then proposes tool calls.
The gate decides

The policy gate classifies every call before it runs. Safe reads pass at G0. Reversible writes are checkpointed. Destructive actions are held at G2.
You approve or deny

Held actions wait for an explicit human verdict. Each approval is single-use and signed with Ed25519. Deny, and nothing runs.
The trail remains

Every step leaves a tamper-evident trail, and approvals land in a hash-chained audit ledger. One OpenTelemetry trace ID follows the task from CLI to gateway.

Guardrails in the default build

Policy gate at the tool boundary

Every tool call is classified before it runs: safe reads auto-allowed, reversible writes checkpointed, destructive actions blocked pending explicit approval.

Signed, single-use approvals

Approvals are cryptographically signed with Ed25519, valid exactly once, and recorded alongside the action they authorized.

Append-only audit ledger

Every prompt, verdict, patch, and rollback leaves a tamper-evident trail. Approvals land in a hash-chained, append-only ledger, and tampering breaks the chain.

Workspace jail

The agent cannot touch files outside your repo. Secret files like .env and private keys are refused, and secrets are redacted before anything reaches a model.

Checkpoints and rollback

Reversible actions get a pre-mutation checkpoint in a shadow git store that never touches your real .git.

Managed gateway

No raw provider keys on your machine. Workspace-scoped virtual keys, budgets, and spend guards. Bring your own key if you prefer.

One trace, end to end

The CLI and the gateway share a single OpenTelemetry trace ID, so every action is traceable across the stack.

Local-first

The agent runs in your terminal. Your code stays on your machine.

Download

The Aerthos CLI is in internal beta and free. Sign in once and download the build for your platform; the portal also has setup instructions.

Builds are published through the customer portal. Sign in to get the CLI for your platform.

Internal beta builds are not yet code-signed, so your OS will warn on first launch. macOS: after unpacking, run xattr -d com.apple.quarantine ./aerthos, or allow it under Privacy and Security. Windows: in the SmartScreen prompt, choose More info, then Run anyway.