guardyn.dev
Start free

Tools

Everything it can look at, and nothing it can change.

The checks are compiled into the agent and grouped the way a responder thinks, in seven questions about a machine. The model chooses which to call. The binary decides what exists, and nothing in it writes.

Start freeWhat it cannot do
30

Read-only checks in the catalogue, every one of them argument-validated on both ends.

29

At most on any one machine: check_integrity only on Linux and event_log only on macOS and Windows.

0

That write, delete, kill or run a command. There is no shell tool to switch on.

The tool set

Every way to look. None to touch.

30 read-only checks. Each one is argument-validated on the endpoint as well as the server, and each reports its own limits. The agent publishes what it actually has when it connects, so an older binary offers fewer tools instead of failing halfway through an answer.

  • What is running

    Processes, their ancestry, their signatures, the files they hold open, and one frame of the screen itself.

    list_processesprocess_treeprocess_open_fileslist_servicesloaded_modulesscreenshot

  • What is reachable

    Listening ports, live connections, where they go, and what resolves them.

    list_socketsoutbound_connectionsresolve_host

  • What survives a reboot

    The persistence surface: launchd, Run keys, services, cron, WMI and shell profiles.

    list_autorunsinstalled_packageslist_containers

  • Who can get in

    Local accounts, administrator membership, recent logons and failed attempts.

    list_usersrecent_logonslist_certificates

  • What changed

    Recent filesystem activity, executables in writable places, and file hashes.

    recent_changesfind_fileshash_filesinspect_pathlist_dirread_text

  • What the defences say

    Antivirus, firewall, disk encryption, SIP, Gatekeeper, Secure Boot and integrity checks, plus a CIS-aligned configuration benchmark.

    security_posturecis_benchmarkcheck_integrity, only where the operating system provides itevent_log, only where the operating system provides itfull_scan

  • What the browser has been doing

    History, downloads and cookie hosts. Metadata only, never a cookie value.

    browsing_historybrowser_downloadsbrowser_cookieslist_browser_extensions
Compiled in only where the operating system provides it, so a given machine offers at most 29. The console shows exactly what each agent published.screenshot stays off until someone turns it on at the machine itself. The model never receives the image. hash_files returns digests only, with no reputation lookup.

Find out what is actually running on your machines.

One binary, one question, one honest answer, including the parts it could not see.

Start freeSee the models
macOS, in Terminal
curl -fsSL https://guardyn.dev/install.sh | sh

Keep it running with launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/dev.guardyn.agent.plist

Windows, in PowerShell
irm https://guardyn.dev/install.ps1 | iex

Needs no administrator rights. It installs under your own AppData.

Linux, in a terminal
curl -fsSL https://guardyn.dev/install.sh | sh

Keep it running with sudo systemctl enable --now guardyn-agent

Then enrol, with the token from your console
guardyn-agent enroll --server https://guardyn.dev --token gdn_enrol_…