kodeblue

kodeblue is an open-source AI blue-team analyst from Problem99 that runs on each Linux server. It learns what normal looks like for the host, notices changes, investigates findings like a security analyst, and can contain attacks when policy allows. The product page says it is not yet live and that signups are notified at launch.

What It Is

kodeblue is a host-level security agent: one instance per Linux server, running as its own unprivileged user. Its workflow runs through learn, watch, triage, investigate, contain and review stages. During learning it takes repeated snapshots and explores the host, then writes a server profile along with monitors and skills specific to that machine. It also flags anything already compromised.

Safety and Guard Rails

The vendor describes several controls for letting an agent act on production systems:

• Agents have no shell, only allowlisted read-only commands, and secret paths are refused.
• Actions go through a socket-activated root helper that re-reads a root-owned policy and refuses to run if others can write it.
• New SSH keys, uid 0 accounts, sudoers, PAM, ld.so.preload and SUID files always require a human.
• Logs, files and process names are treated as hostile input, and agents cannot browse or fetch.
• Each action is journaled with an undo recipe, rate-limited and posted to Slack.

Response mode can be set to off, recommend or contain. The default asks an operator to approve containment requests.

Deployment Model

The code is described as Apache 2.0, with the repository opening to everyone at launch. It ships as one binary per server, sandboxed by systemd. It works with any OpenAI-compatible endpoint, including self-hosted models; without a model, sensors and detection still run. An optional self-hosted hub gives one console for incidents, live agent reasoning, approvals and Slack delivery, and servers are added with an install script. The vendor estimates model costs of cents per day, with a daily budget cap.