← Back to Discover

Vestige

Local, rule-based safety layer for AI agents: a gate checks risky actions before they run, and a memory server records every write and action in an append-only log.

MCP serversCoding agents
Visit website ↗

What it does

Vestige is aimed at people who let AI agents run commands and write to memory on their own. The site calls it a local, deterministic safety kernel and a fail-closed runtime firewall: the model proposes an action, a rule-based gate decides whether it goes ahead, and each action leaves a receipt. It has two parts. Operator Lite is a single-file gate that hooks in before an agent's tool calls, on Claude Code, OpenClaw or other hosts with a command-hook port. It starts in shadow mode, which records verdicts without blocking, and replays the last 30 days of Claude Code history so you can see what its 27 rules would have stopped. The rules cover areas such as destructive SQL, force-pushes and reverse shells. The site notes that it only blocks what is routed through hooked tools. The memory server records each write in Strata, an append-only log, and returns a receipt. A tool called causal_walk traces a failure backward over recorded commits, tool calls and memory writes instead of relying on similarity search. An install script puts the Vestige binaries on the machine, and per-client guides or an optional setup wizard connect the memory server to clients such as Claude Code, Codex, Cursor, VS Code with GitHub Copilot, OpenCode, Windsurf, Xcode and JetBrains. The code is licensed AGPL-3.0-only. Operator Lite is free, and Vestige Operator is a separate paid edition sold as a one-time purchase.

Capabilities

  • Gate that checks agent tool calls before they run, starting in shadow mode
  • 27 built-in rules covering destructive SQL, force-pushes, unreviewed publishes and more
  • Replays recent Claude Code history to show what would have been stopped
  • Memory server that logs every write to an append-only record with receipts
  • causal_walk traces a failure back through recorded commits, tool calls and memory writes
  • Setup guides for Claude Code, Codex, Cursor, VS Code, OpenCode, Windsurf, Xcode and JetBrains

When to use it

  • Letting a coding agent run commands with a check in front of the risky ones
  • Keeping an auditable record of what an agent wrote to memory and did
  • Finding the cause of a breakage in an agent session from recorded history
  • Trying a guard in observe-only mode before turning blocking on