Documentation

guardyn.dev puts a read-only agent on your machines and lets you ask a security analyst what is happening on them. Three steps, and the third one is the product.

What it is#

An agent you install collects the evidence a responder would collect. A model of your choice reads that evidence and answers your question, quoting what it found. The agent cannot run a command it is sent, cannot change anything, and cannot read files outside a small forensic allowlist.

It is not an antivirus and not an EDR. There is no signature database, no content scanning, no memory forensics, no network capture and no real-time interception. It will never tell you a machine is “clean”; it will tell you what it checked, what it found, and what this method cannot see.

Getting started#

1. Create a workspace. Signing up gives you 100 credits and two endpoints on the free plan, with no card.
2. Install the agent. One static binary. See Installing the agent.
3. Ask something. In the console, start a new investigation, choose the machine in the menu that reads No machine attached, and ask in plain language. “Is anything odd running?” is a perfectly good first question.

What a credit is#

One credit is one US cent of retail model value. Every model carries its own price and its own margin, both published on the pricing page. A single-question investigation on the balanced tier is usually 8 to 25 credits; a full compromise assessment on the frontier tier is 60 to 200. Follow-up questions in the same conversation cost a fraction of the first, because the prompt cache does most of the work.

Running a check by hand — from the machine page or the automation API — costs nothing, because no model is involved.

Choosing a model#

The same investigation runs on Claude, GPT or Gemini. Pick per conversation. Reasons to switch:

• A second opinion. If a finding looks wrong, ask a different vendor’s frontier model the same question. They fail differently.
• Cost. “What is listening on port 8443” does not need the frontier tier. The fast tier answers it for a fraction of the credits.
• Depth. A machine that looks genuinely compromised is worth the most capable model you have access to, at high effort.

A model that cannot call tools cannot inspect a machine, so it is not offered when a machine is attached.

Findings#

What the analyst concludes can be kept as a finding — a work queue rather than a log. The same problem raised in three conversations is one entry with a higher count, not three rows. Findings carry a severity, a confidence level with a reason, the evidence, and a specific action.

Automation#

A scoped API key (Settings → API keys) can issue enrolment tokens for an unattended rollout, list the fleet, and run individual checks. Useful for a nightly posture sweep or for enriching a SIEM alert with what the machine actually looks like right now.