SemaMesh: eBPF-based firewall for AI Agents(blocks destructive prompts)

Hacker News

Hello HN, We built an open-source, sidecarless service mesh to govern autonomous AI agents on Kubernetes. The Problem: Standard meshes (Istio/Cilium) operate at L4/L7. They see connections, but they don't see intent. If an autonomous agent gets stuck in a loop and burns $1,000 in OpenAI tokens, or decides to run DROP TABLE to "optimize storage," a standard mesh sees a valid HTTP 200 OK. The Solution: SemaMesh uses eBPF (sock_ops) to transparently intercept outbound traffic from AI pods and route it through a local semantic proxy (Go) that enforces "Layer 8" policies. Features: . eBPF-based: No sidecar injection required. . Semantic Blocking: Parses JSON prompts to block high-risk intent (e.g., "delete database") before it leaves the node. . Stateful Pause: Integrates with CRIU to freeze/checkpoint a rogue agent's process state for forensics instead of just killing the pod. . Token Quotas: Rate limit by $$ cost, not just requests per second. Tech Stack: . Datapath: C (eBPF) . Proxy/Control Plane: Go . Orchestration: Kubernetes (DaemonSet/Operator) We just released v0.4.0 with a "Smoke Test" script that spins up a local Kind cluster and simulates a "Rogue Agent" attack so you can see the blocking logic in action. Repo: https://github.com/semamesh/SemaMesh Would love feedback on the eBPF interception logic or the CRIU integration approach.

Visit product View on Hacker NewsJan 30, 2026

Share card

Actual performance

2points

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Product HuntOn track for Day 1 leaderboard · Strong signals: agents, agent, openai · Missing: mac, macos, cursor

80%80% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

best fitHighest predicted score across all platforms for this description.

Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting

76%76% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

Hacker NewsMay not resonate with HN audience · Strong signals: just released, ide, 000 · Missing: https docs, excited, exist

43%43% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

TrustMRRLess likely to generate early MRR · Missing: mobile apps, ios, personal

33%33% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive

31%31% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

21%21% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

0%0% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

A Firewall for AI agents with auditing32%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

A Firewall for AI agents with auditing

Hacker News4

Trajeckt, a Firewall for AI Agents30%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Trajeckt, a Firewall for AI Agents

Hacker News2

HELM AI Kernel37%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

HELM — the execution firewall for AI agents

Indie Hackerscommitment-full-time

Deckrd35%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

The Firewall for Humanity.

Indie Hackerscommitment-full-time

sn00p – poc app firewall31%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

sn00p – poc app firewall

Hacker News2

TOTP Based Port Knocking -- two factor firewall47%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

TOTP Based Port Knocking -- two factor firewall

Hacker News5

connect-or-cut -- Stateless LD_PRELOAD based firewall47%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

connect-or-cut -- Stateless LD_PRELOAD based firewall

Hacker News3

A Prompt-Injection Firewall for AI Agents and RAG Pipelines26%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

A Prompt-Injection Firewall for AI Agents and RAG Pipelines

Hacker News4

Crowdsec, the behavior and reputation-based collaborative firewall60%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Crowdsec, the behavior and reputation-based collaborative firewall

Hacker News17

VimFreeDrag – Move Blocks of Text in Vim53%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

VimFreeDrag – Move Blocks of Text in Vim

Hacker News5

Browse all products Analyze your launch