Wirken: Open-source AI agent gateway
Wirken is an open-source gateway that sits between messaging apps and AI agents. It assumes any agent can be turned against its owner and limits what a compromised one can reach.
Take an agent that reads your chats and email, holds the keys to your accounts and can run commands. One hidden instruction in a message or a shared document could talk it into leaking a secret or rewriting files. Wirken connects Signal, WhatsApp, Telegram, Matrix, Discord, Slack, Teams, Google Chat and iMessage, plus a web chat, and runs each channel as a separate process that holds only its credentials.
Locked vault, caged shell, signed log
Credentials sit in an encrypted vault and are supplied at the edge, so neither the agent nor the model handles them. Shell commands run in an ephemeral container with no network access, and if the sandbox is unavailable, execution is refused. Reads run freely. Actions that change something ask for approval the first time and remember the answer, while deleting, installing or touching credentials asks every time.
Every action is written to a signed, hash-chained log before it runs, attributed to the person who triggered it. Verification works offline. Sample output shows 1234 rows across 7 sessions and 24 verified chain-head signatures, which demonstrates the check running and says nothing about any deployment. An altered entry fails verification.
What still gets through
Outbound traffic is only partly contained: MCP server child processes and the LLM client make their own outbound connections. Injection detection flags suspicious input and lets it through. Agents share the gateway’s address space, and only the channel adapters run as separate processes.
If you run Wirken in a shared channel, one person’s Tier 2 approval covers every sender until it expires. The tamper check depends on a key kept off the machine, and an attacker running as the same user who rewrites both the log and the key can evade it. Removing the data directory destroys the audit log, so the project recommends exporting it first.
Docker is required for the sandbox, which is on by default. Without Docker, shell commands are unavailable and the other features keep working. Setting the sandbox mode to off lets commands run with no container, and the gateway warns at startup. The installer is a shell script for Linux and macOS with a published hash to check before piping it to a shell, while Windows 11 has a separate path and a different feature set.
Wirken is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
