Requirements and spec sheet
Everything an administrator or assessor needs on one page. Print it or save it as a PDF for your security package.
On this page
At a glance#
- Product
- Vardhold 0.1 (pre-release), by Dawnstar Labs
- Purpose
- Discovery, policy enforcement, human approval and tamper-evident audit for AI agents on Windows endpoints
- Deployment
- On the endpoint. No cloud service, account or outbound connection is needed.
- Delivery
- One per-machine MSI (x64), Authenticode-signed, with a CycloneDX 1.6 software bill of materials
- Agents governed
- Claude Code, Claude Desktop, Cursor, Windsurf, VS Code with GitHub Copilot, GitHub Copilot CLI, OpenAI Codex CLI, Gemini CLI, Aider, Ollama, LM Studio, OpenClaw and any MCP server (stdio or HTTP)
- Checked before they run
- Claude Code (hook), Cursor (hooks), every MCP server routed through the Vardhold proxy
- Recorded as they happen
- File writes, deletes, process starts and network connections of every agent process (Windows ETW)
- Verdicts
- allow, log, ask (hold for a person), block
- Modes
- monitor (record only), enforce, strict (unmatched checked actions need approval)
System requirements#
- Operating system
- Windows 11 64-bit (tested). Windows 10 64-bit is supported by the installer.
- Architecture
- x64
- Prerequisites
- None to install separately. The .NET 10 runtime is bundled. The tray app uses Microsoft Edge WebView2, included in Windows 11.
- Privileges
- Administrator to install. The service runs as LocalSystem.
- Network
- None required. The local API listens on
127.0.0.1:47823only. Optional outbound connections go only to the SIEM destinations you configure. - Agent versions
- Claude Code 2.1.295 or later for the fail-closed hook. Cursor with enterprise hooks support.
- Performance
- About 45 ms added to each checked Claude Code tool call (native-compiled hook). Telemetry is filtered to agent processes.
Components#
| Component | Runs as | Role |
|---|---|---|
| Vardhold service | LocalSystem, automatic start, restarts on failure | Policy engine, approval queue, audit log, discovery, telemetry, exports and the local API |
| vardhold-hook | The signed-in user, started by the agent | Asks the service before each Claude Code or Cursor action |
| vardhold-mcp-proxy | The signed-in user, started by the MCP client | Sits between an MCP client and server and checks every tool call |
| Tray app and dashboard | The signed-in user | Approval prompts, status, agents, timeline, alerts, policy editor, settings |
| vardhold (CLI) | An administrator | Status, policy, mode, kill switch, export and integrity checks for scripts and incident response |
Files and data#
- Program files
C:\Program Files\Vardhold- Data folder
%ProgramData%\Vardhold, limited to SYSTEM and Administrators- Audit database
- SQLite (
vardhold.db) in the data folder, write-ahead logging - Retention
- 30 days by default, configurable. Exports keep the long-term copy.
- Secrets in events
- Passwords, tokens and API keys are redacted before anything is stored or exported
- Uninstall
- Removes the hooks, restores MCP client configurations, removes firewall rules Vardhold added, and keeps the audit data as evidence
Integrations#
| Destination | Transport | Format |
|---|---|---|
| Splunk | HTTP Event Collector over HTTPS | OCSF 1.1 JSON |
| Any SIEM | Syslog over TLS (RFC 5425), TCP or UDP | CEF |
| Files, for any log shipper that reads a folder | Local folder | OCSF 1.1 NDJSON |
| Windows Defender Firewall | Local rules, one visible group per agent | – |
| Software deployment | Intune, Configuration Manager, Group Policy or any MSI tool | Silent MSI with properties |
Security properties#
- Audit integrity
- Each record chained to the previous one with HMAC-SHA256 under a per-machine key; approvals, alerts and policy versions sealed with the same key; chain head anchored in the SIEM
- Key protection
- Audit key encrypted with Windows DPAPI (machine scope)
- Cryptography
- Performed by Windows CNG, DPAPI and SChannel only; FIPS-approved algorithms only. See Cryptography and FIPS.
- Loosening protection
- Needs administrator confirmation through a Windows UAC prompt and an elevated Vardhold window
- Failure behaviour
- Fail closed by default: if the service cannot be reached or an approval times out, the action is blocked
- Local API
- Loopback only, token-authenticated, rejects foreign Host and Origin headers
Support and contacts#
- Sales and pilots
- sales@dawnstarlabs.com
- Support
- support@dawnstarlabs.com
- Security reports
- security@dawnstarlabs.com
Vardhold is pre-release software and is not certified or accredited under any framework. Specifications may change before general availability.