04 , run and monitor
Prepend faramesh run to your agent command. Faramesh detects the framework, patches tool dispatch, strips ambient credentials, and activates the strongest enforcement available on your OS.
Useful flags for faramesh run:
--enforce auto|full|minimal|noneEnforcement level (default: auto).--brokerStrip ambient API keys from the child process.--policyPolicy file to load.--no-seccompSkip seccomp-BPF (Linux).--no-landlockSkip Landlock filesystem restrictions (Linux).--no-netnsSkip network namespace (Linux + root).Start the Faramesh governance daemon. Agents connect via the Unix socket.
Pass these to faramesh serve to configure the daemon.
--data-dirWhere WAL/DB files are stored.--socketUnix socket path for the SDK adapter.--log-leveldebug | info | warn | error--metrics-portExposes /metrics for Prometheus.--proxy-portStarts the HTTP proxy adapter.--grpc-portStarts the gRPC daemon adapter.--mcp-proxy-portStarts the MCP HTTP gateway.--mcp-targetTarget MCP server URL (used with --mcp-proxy-port).Recommended baseline for running Faramesh in production.
Stream all verdicts as they happen.
Stream every PERMIT / DENY / DEFER verdict.
Only show decisions for a specific agent ID.
Check that the audit log has not been tampered with.
Apply a new policy file without stopping the daemon.
Show the full rule context and reason for the last blocked action.
Need help? Use any of these support options.