Checks your machine's real configuration, scans for viruses, and watches your AI coding assistants — then explains every finding in plain language, with a one-click fix.
What Bulwark does
From SSH keys and sudoers to leaked API keys in your AI assistant's memory — every check runs locally and explains itself in plain language.
Scans Claude Code, Cursor, Copilot, Codex and Gemini for secrets leaked into transcripts and memory — and for agent config a prompt injection could turn into code execution: malicious MCP servers, auto-approve "YOLO mode", the Rules File Backdoor.
Tighten ~/.ssh permissions, harden sshd_config, add a passphrase to every unprotected key, redact leaked secrets — dry-run first, reversible, with a backup.
Full ClamAV integration with live per-file progress, engine and database age, and a distro-aware install command when it's missing.
"Your computer needs a little attention" — not a wall of CVE IDs. Every issue is ranked and names the exact file to change, with a Safety score for the whole machine.
A background loop re-scans on a schedule and speaks up only when something new appears. No network calls, ever — your history lives in a local database.
bulwarkctl scan --ssh user@host checks another machine over your existing SSH — keys, agent and jump hosts included. One laptop, every server.
One Rust engine, two front-doors: a terminal on a headless box, or a themable desktop app. Same rule pack, same local history.
How it works
One click runs every check you enable — system configuration, viruses, and your AI coding assistants. No account, no setup.
Findings are sorted Important → FYI, each named to the exact file or setting, with a Safety score that tells you where the whole machine stands.
Apply the safe fixes with a dry-run and a backup, or copy the exact command. Every change is reversible by design.
Make it yours
Light or dark, with an accent and sidebar colour you pick. Bulwark is built to look like part of the desktop it protects — not a visitor.
A closer look
Free, open source, and everything stays on your computer.
