Put a read-only agent on your machines. Ask what is happening on them. It pulls the live evidence a responder would pull — processes, sockets, autoruns, logons, hashes, posture — and tells you what it means, with the pid, the path and the address quoted.
500 credits on signup. Two machines on the free plan, forever.
> Is anything odd on build-01?▸ list_processes unsigned_only=true 1.2s▸ list_sockets state=listening 0.4s▸ list_autoruns suspicious_only=true 0.9s▸ hash_files root=tmp 3.1sSuspicious — investigate.An unsigned binary /tmp/.cache/nodeh (pid 4312, started03:14 UTC) holds an established connection to 203.0.113.5:443and is referenced by a launchd plist written 40 minutesearlier. Three facts that are individually ordinary andtogether are not.Confidence: high— the plist, the binary and the socket agree on timingDo now: capture /tmp/.cache/nodeh before it is removed, thenkill 4312. Check whether any other host in the fleet hastalked to 203.0.113.5.
The first two take about a minute. Then you just ask.
One static binary, no dependencies, on macOS, Linux or Windows. It dials out — it never listens on a port, so there is no inbound firewall rule and nothing on the endpoint to attack.
$ guardyn-agent enroll \
--server https://guardyn.dev \
--token gdn_enrol_...
enrolled build-01 (darwin/arm64)One long-lived outbound stream. While it is open the machine is inspectable in real time; when it closes, the console says offline instead of guessing.
$ guardyn-agent connect connected as build-01 26 tools offered, elevated=true waiting for jobs
Pick a machine, pick a model, ask in plain language. It calls the tools it needs — in parallel — reads what comes back, and answers with the evidence attached.
> What is listening on build-01? ▸ list_sockets state=listening Four ports. Three expected. One is not: 8443, held by an unsigned binary in /tmp.
28 read-only checks, each argument-validated on the endpoint as well as the server, each reporting its own limits. The agent publishes what it actually has on connect, so an older binary in the field simply offers fewer tools rather than failing halfway through an answer.
Processes, their ancestry, their signatures, and the files they hold open.
list_processesprocess_treeprocess_open_fileslist_servicesloaded_modulesListening ports, live connections, where they go, and what resolves them.
list_socketsoutbound_connectionsresolve_hostThe persistence surface — launchd, Run keys, services, cron, WMI, shell profiles.
list_autorunsinstalled_packageslist_containersLocal accounts, administrator membership, recent logons and failed attempts.
list_usersrecent_logonslist_certificatesRecent filesystem activity, executables in writable places, and file hashes.
recent_changesfind_fileshash_filesinspect_pathlist_dirread_textAntivirus, firewall, disk encryption, SIP, Gatekeeper, Secure Boot, integrity checks.
security_posturecheck_integrity*event_log*full_scanHistory, downloads and cookie hosts — metadata only, never a cookie value.
browsing_historybrowser_downloadsbrowser_cookieslist_browser_extensions* Compiled in only where the operating system provides it, so a given machine offers a subset. The console shows exactly what each agent published.
No command execution — not with an allowlist, not with escaping, not “just for diagnostics”. No writes. No arbitrary file reads: content comes back only for a small allowlist of forensic paths, and a deny list for keys, .env files and credential stores beats the allowlist every time, matched against the canonicalised path so a symlink cannot walk around it. An investigation console that can read any file is a data exfiltration tool with a nice interface.
The same investigation runs on Claude, GPT or Gemini. Pick per conversation, get a second opinion from a different vendor on a finding you do not believe, and let an administrator decide which tiers each account may reach.
Anthropic, OpenAI and Google are first-class. Anything that speaks OpenAI’s dialect — OpenRouter, Together, Groq, vLLM, a model on your own hardware — is a base URL and a row in the catalog, not a code change.
Each model carries its own input, cached-input and output price and its own margin. When a provider changes a rate, an administrator edits a field. No deploy, no silent margin loss.
A rate limit or a refusal moves the turn to the next model in the chain. The console says which model answered, because a silent downgrade to something cheaper is a support ticket nobody can debug.
Thinking blocks are only ever replayed to the model that produced them. Switching model mid-conversation rewrites the history into the new provider’s shape instead of leaking a format it will reject.
Billing platforms meter usage; they do not gate it. By the time a meter event is posted the tokens are already bought. So the balance, the check and the circuit breaker live here, in front of the model call.
One binary, one question, one honest answer — including the parts it could not see.