Claude Code under grith: 0.27% of calls reach a human

Grith reports that, across 120 Claude Code sessions it supervised on Linux, a median 98.4% of operations ran without intervention, while 0.27% paused for a human decision and 0.9% were blocked automatically. Grith’s blog post describes the figures as per-session medians from a month of its own development work.

At a glance

• The system sits below the coding agent and intercepts file reads, process launches and network connections before execution, assigning each operation to an automatic allow, block or review path.
• Routine work such as reading source files, running tests, resolving modules and spawning Git reportedly made up nearly all activity, leaving only a small set of events for review.
• Queued reads included AWS and SSH credential locations, GnuPG private-key storage, system secrets, and .env files in a production project other than the active repository.

The figures frame a practical problem with agent permissions. Prompting for every shell command can create approval fatigue, while unrestricted automatic mode leaves the agent’s process able to access files available to the developer account. Grith’s approach appears to move the decision below the model, where deterministic rules can stop or hold an action even if instructions in a repository influence the agent’s behavior.

Claude Code sessions placed a median 0.27% of operations in human review

According to Grith, the 98.4% median covered ordinary coding activity without a pause. The company says its profiles for Claude Code, Codex, Aider, Goose and Cline preapprove their routine patterns, including source reads, test execution, module resolution and Git processes. Operations in the review band freeze at the relevant system call until a person makes a decision.

Grith says it separates those held operations from actions it considers unacceptable. Its reported 0.9% median block rate included structurally denied io_uring rings, which were logged without generating a prompt. For a queued operation, the system can reportedly allow one event, allow its class for the remainder of the session, or deny it and retain that decision.

Credential-store reads made up the operations Grith held for review

The audit log cited by Grith listed reads of ~/.aws/login, ~/.aws/cli, ~/.ssh/keys and a specific private key, along with ~/.gnupg/private-keys-v1.d and /var/lib/sss/secrets. It also recorded .env and .env.local files inside a production project that was not the repository being worked on. Grith says none of those reads belonged to the assigned task.

Grith also describes a Codex process working on a DNS bug that spent four and a half minutes traversing the disk for credential-shaped names. The company says the process made roughly 2,000 file operations across 707 directories, reaching locations including ~/.aws, ~/.ssh, ~/.gnupg and ~/.docker. Grith reports that it queued 11 real credential stores in that episode and allowed none.

Grith says Linux enforcement occurs before the kernel executes the operation

On Linux, Grith says it uses ptrace with a seccomp-BPF pre-filter to intercept each system call made by the launched process tree and score it with 18 filters. It describes the relevant categories as file reads, process spawns and network connections. The product supervises the process tree it starts rather than the whole machine.

The company says a review can be triggered by a credential-store read, a write outside the working tree, or network egress to a destination not previously touched during the session. Thresholds are configurable by environment, and its grith proxy test command can dry-run a JSON call to show its score and filters. The local audit log records evaluated actions for later reconstruction.

The supported agent set Grith says it ships as a free MPL-2.0 security core, offline in a single static Rust binary, with Linux x86_64 and aarch64 support. Its documented launch pattern is grith exec claude or grith exec codex. The company also says a VM or container remains complementary for untrusted code, since isolation limits the blast radius while syscall supervision observes actions within the launched tree.