NEMESIS DEFENDER

Deterministic enforcement to contain LLM agent autonomy. Probabilistic instruction does not contain; the Defender does.

exit 2 · fail-closed · 100% local

Defense in depth

Independent layers: if one fails, the next holds. Every block is recorded in the ledger.

pretool

Pretool hook

Intercepts the agent action before it runs. POSIX contract, exit 2, fail-closed.

defender

Defender scanner

AST-based code reading and heuristics: hunts malware, reverse shells and supply-chain.

eBPF / BPF-LSM

Kernel confinement

Kernel layer (Linux) that blocks command and egress even outside the IDE hook.