Inner Warden: an autonomous eBPF security agent that fights back

Most security tools only send alerts. Then someone has to wake up, read logs, and react.

Inner Warden does it differently. It detects, decides, and blocks threats in real time, locally on your server, with a tiny footprint of around 29MB.

What it does

40+ eBPF kernel hooks (tracepoints, kprobes, LSM, XDP)

Behavioral DNA tracking for processes and attackers

On device anomaly detection with a small autoencoder

Cross layer correlation between kernel, userspace, and network

Wire speed blocking through XDP

Automatic honeypot, JA3/JA4 fingerprinting, Sigma and YARA rules

Mesh network between nodes, so when one detects, all the others block

Dry run mode is the default, so it is safe to test

Who is it for

Self hosters and homelab people

Anyone running a Linux server exposed to the internet

Developers running AI agents (LangChain, CrewAI, OpenAI tools, and similar)

SREs and sysadmins who want autonomous response instead of 3am…