Dawnstar Labs Vardhold Docs

How Vardhold works

Vardhold sits between AI agents and the machine. It asks one question before every action it can see coming, and records everything else as it happens.

4 min readUpdated October 2026Vardhold 0.1 (pre-release)

On this page
  1. The problem it solves
  2. The parts
  3. The life of an action
  4. Before it runs, or as it happens
  5. Modes
  6. Evidence you can rely on

The problem it solves#

AI coding agents such as Claude Code, Cursor and GitHub Copilot, and the MCP servers they call, run shell commands, read and write files, and reach the network with every right the signed-in person has. Endpoint security sees the processes that result. It does not see which agent started them, why, or whether anyone agreed.

Vardhold adds that missing layer: it knows the agents, decides what each one may do, involves a person when it matters, and keeps a record that stands up in an audit.

The parts#

Vardhold architecture AI agents in the user session send each action through vardhold-hook or the MCP proxy to the Vardhold service. Its policy engine allows, logs, asks or blocks. Ask decisions wait in the approval queue for a person in the tray app. Everything is written to the audit log and exported to the SIEM. Windows telemetry records every agent process, and the service can suspend, end or firewall an agent. User session Vardhold service · LocalSystem Outside AI agent Claude Code Cursor MCP clients vardhold-hook before each action MCP proxy every tool call Tray app a person decides Policy engine allow · log · ask · block Approval queue held until a person decides Audit log keyed hash chain, secrets redacted Windows telemetry files, network, processes Response suspend · end · firewall Your SIEM Splunk · syslog · files
Gold paths are checked before the action runs. The dashed path is recorded as it happens, for every agent process.
PartWhat it does
ServiceRuns as LocalSystem and holds the policy, the approval queue and the audit log. It listens on 127.0.0.1 only, so it is never reachable from the network.
Hookvardhold-hook is registered machine-wide with Claude Code and Cursor. Before each tool call, it sends the action to the service and returns the verdict to the agent.
MCP proxyvardhold-mcp-proxy sits between any MCP client and server and checks every tools/call, including the paths, URLs and commands in its arguments.
TelemetryA private Windows ETW session records process starts, file writes and deletes, and network connections of every agent process, including agents without hooks.
Tray app and dashboardShow approval prompts and the dashboard: agents, live timeline, approvals, alerts, policy editor, MCP servers and settings.
Admin CLIvardhold covers the same controls for scripts and incident response.

The life of an action#

  1. The agent asks to act. Claude Code wants to run git push --force origin main. Before it runs, the hook sends the service the agent, the action (shell.exec), the command and the working folder.
  2. The policy decides. Rules are read top to bottom and the first match wins. Paths are compared the way Windows resolves them, and commands are checked against the files they name, so spelling a path differently does not change the outcome.
  3. A person decides, when the rule says ask. The action waits in the approval queue. The tray app shows what the agent wants, the rule that asked and how the same request was decided before. Deny is one click; allowing needs an administrator's confirmation.
  4. The agent gets its answer. Allowed actions run. Blocked actions do not, and the agent is told which rule stopped it, so it can explain and choose another way.
  5. Everything is recorded. The event is written to the audit log with the agent, process, target, rule and verdict, chained to the record before it, and streamed to your SIEM.

Before it runs, or as it happens#

How much control Vardhold has depends on how an agent can be reached. Vardhold is explicit about the difference, on the dashboard and in every event (source).

PreventionChecked before it runsClaude Code and Cursor through their hooks, and every MCP server through the proxy. An action that breaks the policy never happens.
Detection and responseRecorded as it happensEvery agent process through Windows telemetry. A rule match raises an alert, and you can suspend, end or firewall the agent, by hand or automatically for headless agents.

Modes#

ModeBehaviourUse it when
monitorRecords and alerts, never blocks or asksLearning what agents do before you enforce
enforceApplies every rule as writtenNormal operation
strictUses each rule's verdict_strict, and any checked action that no rule matches needs approvalHigh-assurance machines, or during an incident

Raising the mode is open to anyone at the PC. Lowering it needs administrator confirmation.

Evidence you can rely on#

Every audit record is chained to the one before it with HMAC-SHA256 under a per-machine key. Approvals, alerts and policy versions are sealed with the same key. Removing, editing or reordering records is detected, and the chain head is recorded in your SIEM every hour so you hold an independent copy to check against. Details: Security model.