Now in beta
Apple Endpoint Security entitlement
Notarized Apple System Extension
Tamper-evident BLAKE3 ledger
Local-first: your monitoring data stays on your Mac or Windows PC
Astragar Limited is a registered Apple Developer, granted Apple’s Endpoint Security entitlement. Every build is signed and notarized.
Requirements: macOS 13 (Ventura) or later, Apple Silicon and Intel.
Aeguard keeps your monitoring data on your Mac. The one thing it can send us is a Report a concern message you choose to write; it’s on by default so we hear about problems, and you can switch it off in-app (Help → Privacy) or leave it off in local-only mode.
New to Windows? Read the install guide
Beta · Free for macOS and Windows
Detects AI agents
100% on-device
No keystroke capture
Local event chain
BLAKE3 verified
AI agent detected · acting autonomously
↳ terminal write to ~/.zshrc · tied to the agent
File fingerprint changed · /Applications
USB device attached · new identifier
Append-only, mirrored to Keychain: if the chain changes, the evidence shows it.
BUILT FOR THE AGENT ERA
Aeguard reads each agent’s own rulebook, its CLAUDE.md and settings, and checks whether what it actually does matches what it declared, flagging violations like an agent reading your SSH keys.
Built on Apple’s Endpoint Security framework, Aeguard sees process launches, file changes, and code injection as they happen, with the responsible process identified.
Every event is cryptographically chained and anchored off-machine, so a rogue agent or malware can’t quietly rewrite history. If something changes, you’ll know.
HOW IT WORKS
Baseline
Records a known-good fingerprint of every file with BLAKE3.
Watch
Monitors files, processes, network, USB, clipboard metadata, browser history and AI-agent activity against the baseline.
Verify
Every event joins an append-only, hash-chained log mirrored to the Keychain; tampering shows.
WHAT YOU GET
File integrity monitoring
Process, network & USB
AI-agent visibility (OpenTelemetry)
Tamper-evident hash chain
Search & alerts
Encrypted, off-machine checkpoints
REAL-TIME DETECTION
code injected into another process
a process latching onto another
signed code tampered after launch
new login & background items
escalations and authorization events
Apple’s malware scanner firing
drivers loading into the kernel
disks and disk images mounting
access to protected files
LOCAL BY DESIGN
HOW AEGUARD FITS ASTRAGAR
DRM identifies & values data
VRM quantifies the impact
GRC maps it to regulation
Aeguard closes the loop at the device
Aeguard is the detection module of the Astragar risk platform.
DOWNLOAD
Requirements: macOS 13 (Ventura) or later, Apple Silicon and Intel.
Aeguard keeps your monitoring data on your Mac. The one thing it can send us is a Report a concern message you choose to write; it’s on by default so we hear about problems, and you can switch it off in-app (Help → Privacy) or leave it off in local-only mode.
INSTALL · WINDOWS
Because each build is freshly signed, Windows and your browser may warn before they recognise it. Here’s how to get it running in under a minute and how to confirm it’s genuinely from us.
Download for Windows
Signed NSIS installer (aeguardwin-setup.exe) · Publisher Astragar Limited
If your browser blocks the download
Chrome: click the ⋯ next to the blocked download, then Keep.
Edge: click the ⋯ on the download, then Keep → Keep anyway.
The blue “Windows protected your PC” box
Click More info, the small link in the dialog.
Confirm it reads Publisher: Astragar Limited; that’s the proof it’s really ours.
Click Run anyway.
That’s the whole thing: More info → Run anyway.
Still won’t unblock? (optional)
Right-click aeguardwin-setup.exe → Properties → General tab → tick Unblock at the bottom → OK, then run it.
How to check it’s genuine
Right-click the file → Properties → Digital Signatures tab. You’ll see Astragar Limited with a valid Microsoft timestamp, the same signature on every build we ship.
