arrowassassin/kintsugi

<p align="center"> <img src="https://arrowassassin.github.io/kintsugi/logo.svg" alt="Kintsugi" width="420" /> </p>

Kintsugi

Let AI agents — and your team — move fast, without wrecking the machine.

A safety net for every command on your box: AI agents are caught before they do damage; the humans (DBAs, operators) get a tamper-evident audit trail with one-command undo.

AI agents now run real shell commands on your computer: rm -rf, git push --force, DROP TABLE, writes straight to disk. Almost always that's fine. The one time it isn't — a hallucinated path, a prompt-injected instruction, a confident wrong guess — there's no undo, and you find out after.

Kintsugi is the seatbelt. It sits between the agent and your system, catches the dangerous command before it runs, explains it in one plain sentence, makes destructive actions reversible, and keeps a tamper-evident record of everything every agent did. Local-first: no cloud, no account, nothing leaves your machine.

Website: https://arrowassassin.github.io/kintsugi/ · Docs: docs/

Real Kintsugi output, looping: hold card → denied timeline → live TUI. (Static frames in docs/img/ if the animation doesn't play.)

Security spine: the decision to hold/deny a catastrophic command is made by deterministic rules, never an LLM. The raw command is always shown verbatim; the model only explains. The event log is append-only and hash-chained, and nothing leaves your machine. See CLAUDE.md for the full rules.

Assurance: an adversarial stress + vulnerability assessment (docs/security-assessment.md) measures it — 0 / 176 dangerous commands leak to Safe across a MITRE ATT&CK + GTFOBins corpus, 1.4M fuzz input