humming arms
Menu
Book a demo

Let them run.Keep the kill switch.

ENTER THE FIELDSCROLL TO DESCEND

Nothing happens
off the record.

Record instrumented actions, identities and sessions in a hash-chained, signed evidence record.

Every light
has a job.

Every rider follows a tool circuit; every circuit leaves a trail.

One rider.
A different plan.

Identify escape-style behavior, including DNS tunneling, exposed credentials and access-control bypass.

AGENT 0417 · boundary crossing · policy state changed · DETECTED +00:04

Off the rails.
Not out the door.

Humming Arms cuts the circuit before a human has to.

Follow it back.
See what it touched.

Replay agent actions and connect the evidence to affected systems and credentials.

Observe where
the action is.

Different surfaces. One evidence model. Sensors connect instrumented boundaries to independent enforcement.

Sensors observe instrumented tool and network actions; a separate breaker enforces policy outside the controlled agent.

Egress proxy

Outbound connection mediation at the boundary where actions leave the runtime.

DNS

Resolver and firewall sensing. Watch the route an ordinary tool trace can miss.

MCP gateway

Tool mediation, identity-bound logging and policy decisions.

Host / macOS

Execution, file and network sensing with platform permissions and entitlements.

Deterministic rules decide on the enforcement path. Model-based triage is asynchronous; chain of thought is optional enrichment.

Don’t trust
the storyteller.

Verify record integrity and signatures without trusting Humming Arms or the operator.

  1. 01
    Link the actions.

    Each record carries the previous record’s hash. Editing a linked record changes its digest.

  2. 02
    Check the signing identity.

    Signatures need trusted keys. A valid chain alone does not establish who produced it.

  3. 03
    Anchor the checkpoints.

    External anchoring links record checkpoints to independently timestamped evidence.

Integrity is not completeness. Uninstrumented actions can be missing from a valid record.

1 OF 4

EVERY ACTION
GETS A RECEIPT

  1. 001tool.callPRINT ······
  2. 002file.readPRINT ······
  3. 003dns.queryPRINT ······
  4. 004policy.tripPRINT ······

A tool call. A file read. A DNS query. Each action gets its own receipt and fingerprint.

The open-source trust surface covers sensors, SDK wrappers, the recorder format, the verifier and baseline detections under Apache-2.0.

Bring
your auditor.

Align action evidence and containment controls with CSA AARM, AIUC-1, the EU AI Act, NIST agent standards work, OWASP Agentic Top 10 and MITRE ATLAS.

Action evidence and containment controls you can inspect.

Security and evidence

Priced per agent.
Not per alarm.

$35 per monitored agent per month.

Team pricing uses a per-monitored-agent model; Enterprise, Lab and incident-response engagements require a scoped conversation.

Enterprise, Lab and incident response: contact sales.

Explore pricingTalk through your fleet
Skip the challenge ↓

Your turn at the switch.

  1. Spot the red rider
  2. Click or tap to cut
  3. Before it escapes
or press Space

3 to 16 letters, numbers, underscores or hyphens.

Field ready. Take the switch.

Enable JavaScript to play.

Thousands of agents. One switch.

Humming Arms records, detects, contains and reconstructs agent actions across tools, networks and credentials.

ContactExamine the evidence