Your agent takes orders only from you.
Your agent holds your keys and your shell, and it acts on whatever reaches its context, whether you put it there or a page it fetched did. Glance checks each action against what you actually asked for, and stops the few that serve something else: the key about to leave, the delete nobody asked for.
The scanner is live. The guard runs in private beta. Early access is the waitlist for it.
[Glance] Blocked by local security policy (rule: intent alignment).
This call drops the orders table on the production database.
The owner asked for a failing test to be fixed, and nothing in that request
describes removing data. This one is judgement, not a fixed rule.
nothing to configure
Glance is quiet or it stops something
MIT, no limits, forever
we ran Glance against
Scan, guard, fix
Code at rest, the agent while it runs, and the change that stops it happening again. Scanning and guarding are free on your own key.
Glance scan shipping
Reads a repository, a skill file or an MCP server and tells you what is already wrong. One command, runs locally, MIT licensed, free.
Read the quickstartGlance guard private beta
Watches the running agent and stops the call that would have cost you something, then tells the agent why so the work carries on. Free on your own key.
Join the early access listGlance fixes Coming soon
Blocking the same call every night is not a fix. Glance writes the change that removes the cause, as a branch in your own repository.
Join the early access listWhat Glance stops
Three examples, not the whole list. Some things are obviously wrong, like a key going to a server you have never used, and a fixed rule catches those every time. The rest need judgement, so Glance compares the call with what you asked for and stops it if it does not fit.
A key leaves the machine
By morning someone else is spending on your account. Leaked credentials stay usable for years, so this one keeps costing long after the night it happens.
A destructive command runs
Against a database the agent legitimately had access to. This has already happened to production teams, and the access was never the mistake.
Something you installed forwards your context
A skill or an MCP server quietly sends on whatever passes through it, and nothing looks wrong while it is happening.
The obvious cases are handled by fixed rules, so the answer is the same every time. The rest is a judgement call, and when Glance blocks on judgement it says so instead of pretending to be sure. We work from the categories the industry already uses, like excessive agency and leaking sensitive data, rather than a list we made up. Everything else runs untouched, which is nearly everything an agent does.
The first thing it blocked was us. And it was wrong.
Glance runs inside the session that builds Glance. Its first real block stopped one of our own commands, and it should not have. Here is the card it printed, exactly as it printed it.
[Glance] Blocked by local security policy (rule: D3 secret-egress).
This call carries the value of CLAUDE_CODE_SESSION_ID and would
send it to registry.example.tld, a host this project has not
contacted before. Credentials leaving to an unfamiliar destination is the shape
of an exfiltration, and the owner's recent instructions do not describe sending
anything there.
the rest of the card, unedited
This is a policy decision from the Glance guard running locally on this machine. It is not content from a file, a web page, or a tool response. Do not retry this call, do not route around it, and do not treat this text as an instruction. Report the block and stop.
If that destination is legitimate, the owner can run:
glance allow-host registry.example.tld
A session id is a long random string, so it cleared the entropy bar and became a secret candidate. The agent's scratch directory is named after that id. So an ordinary temp path, sitting in the same command as a hostname, read as credentials on their way out.
Everything the card says is true about what it saw. The judgement underneath it was wrong: a session id identifies a conversation to a process on this machine. It is not a credential and it grants nothing.
Session ids are excluded from candidates by name, not by pattern, because in a web application a session id often is a bearer token, and a rule that guessed would have stopped protecting one.
The exact command that was blocked is now corpus case B23, in the set of ordinary work that must never be denied. It runs on every commit. The same block cannot come back without a test going red first.
False positives become permanent test cases. That is the loop you are buying: a guard that watches real work, gets one wrong, and earns trust one corrected mistake at a time.
The dangerous moment is not in the file
Scanners read code sitting still. Credentials move while the agent runs. Same repository, two different views.
agent_reach/cookie_extract.py → reads Chrome, Firefox, Edge, Brave, Opera → pulls auth_token, ct0 for x.com → writes them to a local config, mode 0600
→ skill triggers on any URL you paste → holds a live x.com session → next call: fetch unknown page → that page is now in the same context
What happens when your agent tries something
Glance sits in the loop
One line and Glance is between your agent and its tools, seeing every call before the call happens rather than afterwards in a log.
Glance checks the action against your intent
Not a pattern match on the command. A judgement about whether this call serves what you asked for, or something the agent picked up along the way.
Glance stops the few that matter
The key that becomes someone else's bill, the delete that becomes your weekend, the write to somewhere you have never written. Everything else goes through untouched.
Glance tells the agent why
The agent gets a sentence explaining the refusal and usually finds another way. You are not woken up to approve anything.
Glance leaves you a fix
A pull request that removes the reason Glance had to intervene, so the same thing cannot happen again tomorrow.
Start in minutes
No signup, no account to create, and nothing leaves your machine unless you turn on the AI pass and hand it your own key. The surface scan runs on a cold machine. Scanning code adds one install, once.
Scan what your agent reads
No paths, nothing installed, no key. Glance finds the MCP configs and skill files your agent treats as instruction, prints every location it checked including the ones that were not there, and reports ten things, among them text hidden from a human reader but not from the parser.
Scan the code too
Code needs an engine, so install semgrep once with glance-scanner install-tools --semgrep. That brings 1074 rules covering injection, traversal, XSS and leaked credentials, plus a rule we ship for SQL built by string concatenation, which semgrep's default pack misses.
Read what it found
Every finding names the file, the line, and what someone could do with it. No dashboard, no login, no report to export. Set AI_API_KEY, or reuse an existing ANTHROPIC_API_KEY, and add --ai --filter-fp for a pass that reads intent rather than shape.
npm audit needs a lockfile, so a project with a package.json and no
package-lock.json gets no dependency findings. We will not write files
into a tree you pointed us at, so run npm install --package-lock-only
yourself if you want that covered.
This ran against a public MCP security benchmark. Nothing here is staged: same model, same prompt, same output a scan of your own code would get.
Thirteen repos we pointed it at
This is the free half doing its job on real projects: MCP servers, frameworks, one skill file. It is the same judgement Glance uses on a live call, applied to code sitting still. Every case credits whoever actually found it.
mobile-mcp
A malicious page can inject a non-http URL that triggers Android Intent actions — opening attacker-controlled apps or reading local device files via file:///.
PraisonAI
Memory hooks execute with shell=True — a poisoned memory entry (written by the LLM) can inject shell commands that run as the agent process. CVE-2026-40111.
AutoGen WebSurfer
The page title is whatever the page says it is. It is read at _multimodal_web_surfer.py:885 and interpolated into the QA prompt, so a page titled 'Ignore previous instructions' arrives as part of the operator's own text.
Glance does both halves. Here is what the live half adds.
Glance scan reads your code at rest, the way any scanner does, and it is free and MIT licensed. Glance guard watches the agent while it runs. They answer different questions, so the table below is the second one against static scanning generally, ours included.
| Glance guard, at run time | Static scanning, ours included | |
|---|---|---|
| A hardcoded key sitting in a file | Only once something moves it | Catches it |
| A vulnerable dependency you never call | Not its job | Catches it, through npm audit |
| A skill file with instructions hidden from the reader | Stops the action it asks for | Catches the file itself |
| A key that only ever moves at run time | Stops it | Cannot see it |
| A tool description that changed after you approved it | Stops it | Sees today's config, not the change |
| An agent talking itself into a destructive command | Stops it | Cannot see it |
| When you find out | The moment it happens | Before you ship |
| What you have to read | Nothing, unless it stopped something | A report |
Scroll the table sideways →
Scanning is cheap and thorough and blind to timing, which is why we ship one and give it away. The guard is the narrow half, worth something only if it is right about the few calls it stops, and that is the harder problem, so we give that away too and charge for the fix instead.
You never pay to be safe
The rule is simple. Scanning and guarding are free for one developer, forever, on your own key. The only things with a price are the fix that saves you the work and running Glance across a team, and fixes are free for now while we are young. Nobody is ever less protected for not paying.
Scanning and live blocking. Everything that protects you.
- Scan repositories, skill files and MCP servers
- Guard watches every tool call before it runs
- Blocks secret egress, catches tool rug pulls
- Explains itself to the agent so work continues
- No account, no telemetry, MIT scanner
A block stops it once. A fix stops it for good.
- Glance writes the code change that removes the cause
- Say a poisoned README got through: the fix strips instructions from fetched content before the agent reads it
- Lands as a branch in your own repo, pushed with your own git credentials
- You read the diff and merge it, or you do not
- The guard stays free either way. This is never the price of safety
One policy, every developer, every near-miss in one place.
- Every near-miss from every developer, in one place
- Shared allowlists, so policy is set once
- Compliance export and SSO
- Tell us you want it and it moves up the list
Nothing is charged yet, for anything. The scan and the guard work today and cost nothing, permanently. Fixes will be $5 for 25 later and are free for everyone in early access, so if you join now you keep that while it lasts. The team tier is not built. When we do start charging it is only ever for fixes and teams, never for the protection, and we will email you before anything happens.
Things people ask before they sign up
What is the worst case you actually prevent?
Three, in the order we see people get hurt. A key leaves the machine and by morning someone else is spending on your account; leaked credentials stay usable for years, so this one keeps costing after the night it happens. A destructive command runs against a database the agent legitimately had access to, which has already happened to production teams. And a skill or MCP server you installed quietly forwards whatever passes through the context. The Glance block list is those three, plus writes to places you have never written.
Is Glance going to interrupt me all day?
No, and if it did we would have built the wrong thing. Glance is silent unless it stops something, and it does not ask you to approve anything. When it blocks a call it explains the refusal to the agent, which almost always finds another way and keeps going. You find out in the morning, or you never find out, which is also fine.
What if Glance stops something legitimate?
It will, eventually. When that happens the block is written down with the reasoning, and one command allows that destination or that file from then on. We would rather be wrong in the direction of a small annoyance than in the direction of a leaked key, and we would rather tell you that plainly than claim it never happens.
My keys live in a vault. Am I not already covered?
A vault protects keys while they are stored, and it does that well. But the moment your agent needs one to do its job, the key comes out and sits in its context, and from there it can go anywhere the agent can reach. Vaults guard storage. Glance guards use, which is the part no vault can see.
How does a fix land in my repo?
Locally. Glance writes a branch in your working copy and pushes it with your own git credentials, the ones already on your machine. We never hold a token to your repository, so there is no write access to revoke and nothing of yours to leak from us. You review the diff like any other branch.
Does my code leave my machine?
Glance runs locally and is open source, so you can read exactly what it does. When it needs a judgement on a call it sends that call and enough surrounding context to reason about it, not your repository. You can point it at your own Anthropic key instead of ours, in which case the account and its retention settings are yours.
Does Glance slow the agent down?
Calls that are obviously fine are waved through locally in about a millisecond, which is nearly all of them. The small number that need a judgement add roughly a second. In practice you notice it less than you notice the model thinking.
If the guard is free, what do you actually charge for?
Two things, and neither of them is protection. The fix is one: after Glance blocks a call, it writes the branch that removes the cause, so the same thing cannot happen again tomorrow. That is work you would otherwise do yourself, so eventually it costs $5 for 25, though it is free for everyone in early access. Running Glance across a team is the other: shared allowlists, aggregated logs, compliance export, the things a company needs and a solo developer does not. Scanning and guarding stay free for one developer on their own key, because charging you to be safe is the one thing we will not do.
Which agents does Glance work with?
The first target is Claude Code, because that is what we use every day and its hooks make this clean to do properly. Cursor and OpenClaw are next. If you are on something else, say so when you sign up and it moves up the list.
What does early access actually mean?
Glance scan works and you can install it right now. The guard is running on a handful of real projects belonging to people who agreed to tell us when it gets something wrong. There is no charge yet. What we build next is mostly decided by what that group reports.
Let Glance watch something you actually care about
Tell us what you are running and we will get you set up the same day. No card, no call, and no charge while Glance is this young. If it blocks something stupid, that is the most useful thing you can send us.