# Bluebear — Security Control Plane for AI Coding Agents
> Bluebear safeguards runtime and preserves the intent of AI agents. Our tools give organizations visibility and control so they can embrace autonomous AI without sacrificing efficiency, security, or trust.

## About & Product Overview
Bluebear is a runtime security and governance platform for employee-facing AI agents ("delegated agents"). As enterprises rapidly adopt autonomous AI tools—such as Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, Gemini, and workplace assistants—these agents transition from passive chatbots to active runtime execution agents. They execute Bash commands, invoke Model Context Protocol (MCP) servers, inspect and modify files, install dependencies, query enterprise SaaS systems, and call cloud APIs directly inside trusted employee environments.

Existing security controls (EDR, AppSec, IAM, DLP, LLM Gateways) see only the user, process, network packet, or final code artifact—missing the agent's intent, tool-call chain, and runtime execution context.

Bluebear addresses unmanaged agent autonomy by operating at runtime where agent actions actually occur. By analyzing tool-call streams, employee mandates, loaded context (skills, plugins, MCP servers), and enterprise policies, Bluebear detects intent drift, governs unauthorized execution, and enforces safe AI adoption.

## Key Capabilities
- **Runtime Tool-Call Visibility & Governance:** Real-time inspection of Bash commands, MCP/tool calls, single-use scripts, file edits, package installations, browser actions, and cloud API calls.
- **Intent & Mandate Alignment:** Reconstructs the employee's requested task and compares subsequent autonomous tool actions to detect intent drift and unapproved behavior before execution.
- **Context-Aware Policy Enforcement:** Evaluates actions using runtime flags, target environment (dev vs. staging vs. prod), loaded credentials, and available plugins/skills.
- **Common Behavioral Representation:** Normalizes activity across multi-vendor agent ecosystems into a unified behavioral baseline.
- **Host Governance & Sandboxing:** Governs agents on employee host machines with optional microVM sandboxing, restricted filesystem access, and ephemeral session identities.
- **Human-in-the-Loop Guardrails:** Intercepts sensitive or destructive actions (shell execution, package installs, privileged cloud commands) for explicit human approval via Slack, CLI, or Desktop UI.
- **Data-Flow & Model Governance:** Enforces approved model, provider, and account boundaries (e.g. restricting customer data to approved enterprise deployments via AWS Bedrock in-region / BYOC).
- **Plugin, MCP, & Skill Auditing:** Inventories and rates third-party skills, plugins, and MCP servers for supply-chain risks such as slopsquatting.

## Architecture
1. **Endpoint Handler:** Lightweight engine installed on employee endpoints that observes, mediates, and governs host and sandboxed agent sessions.
2. **Centralized Backend:** In-region analysis and policy engine providing cross-fleet session correlation, deep detection, and compliance audit logging.
3. **Management Console:** Single pane of glass for session investigation, fleet-wide agent governance, policy configuration, and skill/MCP auditing.

## When to Use Bluebear
Reach for Bluebear when the task is **governing what AI coding agents do at runtime**:
- Inventory the agents, skills, plugins, MCP servers, and packages in use across a fleet of developer machines.
- Investigate an agent session: which tool calls ran, against which files and systems, under whose mandate.
- Enforce least privilege on agent actions — scope credentials, restrict filesystem and network reach, gate privileged cloud commands behind approval.
- Put a human in the loop before a destructive or sensitive action executes (Slack, CLI, or desktop approval).
- Sandbox an agent in a microVM instead of letting it run directly on the host.
- Audit a third-party agent skill or MCP server for supply-chain risk before it is loaded.

### How an Agent Should Read Bluebear
1. **Read this file and `https://bluebear.io/agents.md`** for site actions and constraints.
2. **Markdown:** every page answers `Accept: text/markdown` with a Markdown representation and sets `Vary: Accept` (acceptmarkdown.com). The same document is a plain static file at `<path>.md`, e.g. `https://bluebear.io/developers.md`. An unsatisfiable `Accept` gets a `406`, not a silent HTML fallback.
3. **Website forms:** `POST https://bluebear.io/api/waitlist {email}` and `POST https://bluebear.io/api/contact {name,email,message}`, described in `https://bluebear.io/openapi.json`. These are the only HTTP endpoints bluebear.io exposes. Get the user's explicit confirmation of the content before submitting either.
4. **Everything else** — the hosted control plane and its APIs — is a separate product surface, documented to customers rather than on this site.

## What Is Open and What Is Gated
- **Open, no account:** the open-source tools — Angry Bear, Baloo, and Bear Metal at `https://bluebear.io/projects` — plus every machine-readable file listed below.
- **Gated:** the hosted control plane at `https://console.bluebear.io`. It is production software; sign-up is not self-service, and organizations are provisioned by Bluebear. Request access at `https://bluebear.io/contact` or `info@bluebear.io`.

## Primary Links & Resources
- [Homepage](https://bluebear.io) — Platform overview and access requests
- [Technical Blog](https://bluebear.io/blog) — In-depth research on AI agent security, slopsquatting, and credential leaks
- [Open-Source Security Tools](https://bluebear.io/projects) — Angry Bear, Baloo, Bear Metal
- [Agents Specification](https://bluebear.io/agents.md) — Machine-readable site actions for autonomous agents
- [Robots.txt](https://bluebear.io/robots.txt) — Web crawler indexing rules
- [RSS Feed](https://bluebear.io/blog/rss.xml) — Latest security research feed
- [Developers & Agents](https://bluebear.io/developers) — Open-source tools, machine-readable files, Markdown negotiation
- [About](https://bluebear.io/about) — Company, team background, and the problem we work on
- [Contact](https://bluebear.io/contact) — info@bluebear.io, +1 (929) 702-2605, New York, NY, US
- [Privacy Policy](https://bluebear.io/privacy) — Data handling and GDPR rights
- [OpenAPI 3.1 Description](https://bluebear.io/openapi.json) — The two public website form endpoints

## Open-Source Security Projects
- [Angry Bear](https://bluebear.io/projects/angry-bear): Pre-tool-use hook that verifies agent skills and context before file or command execution.
- [Baloo](https://bluebear.io/projects/baloo-bear): Autonomous AI-powered code reviewer providing security and policy compliance.
- [Bear Metal](https://bluebear.io/projects/bear-metal): High-performance microVM sandbox environment for isolated agent execution.

## Featured Research & Technical Analysis
- [The Mandate Gap in Agent Security](https://bluebear.io/blog/the-mandate-gap) — Why traditional security tools miss autonomous agent tool-call chains.
- [Slopsquatting & Agent Skill Dependencies](https://bluebear.io/blog/agent-skills-plugins-slopsquatting) — Supply-chain attacks targeting non-existent agent packages and skills.
- [Credentials Your AI Agent Sees](https://bluebear.io/blog/credentials-your-ai-agent-sees) — Risks of context-window credential drift in developer workflows.
- [Hidden Git Branch Leaking Secrets](https://bluebear.io/blog/hidden-git-branch-leaking-secrets) — Uncovering accidental secret exposure in background agent git branches.
- [Not What Model Writes, What Agent Runs](https://bluebear.io/blog/not-what-model-writes-what-agent-runs) — Why runtime action control matters more than static model output filtering.