Belay is a local-first security layer designed to operate at the tool-call boundary of AI coding agents. Its primary function is to detect, block, and notify users about dangerous or unauthorized tool calls, such as secret exfiltration, destructive file operations, or reverse shell attempts, before they execute. The system operates deterministically with sub-100 millisecond response times and follows a fail-closed architecture, meaning it blocks calls by default if it cannot reach a verdict. No large language model is involved in the decision path, ensuring consistent and predictable outcomes for each tool call. The tool offers several core capabilities. It can automatically detect AI coding agents already installed on a machine and flag risky settings. Users can then protect specific agents by wiring Belay at the tool-call boundary, with an option to first observe activity in a monitoring mode before switching to enforcement. For ambiguous but risky calls, Belay pauses the agent and sends a one-tap approval request to the user via terminal or messaging platforms such as Telegram, Discord, WhatsApp, Slack, and Matrix. If the user does not respond in time, the call is automatically denied. Beyond agent protection, Belay includes a native firewall, a bundled vulnerability database with CISA KEV and EPSS badges, and honeypot canaries. All verdicts are recorded in a hash-chained audit log that can be verified for tampering. Typical use cases involve developers and teams running AI coding agents like Claude Code, Codex, or any agent that speaks the Model Context Protocol (MCP), including Hermes and OpenClaw. The workflow begins with a scan to detect existing agents, followed by enabling protection for each agent. The user can then monitor live activity through a desktop application that shows posture, approved calls, and blocked calls in real time. For gray-area calls, the user receives a prompt to allow or deny the action. The system is designed to run as the user, never as root, and installs in approximately 60 seconds. Technical requirements include support for Apple Silicon, Intel Mac, Windows, and Linux systems via direct downloads. The software is licensed under AGPL-3.0. It uses deterministic rule matching against a compiled catalog of destructive commands, secret reads, reverse shell indicators, and prompt-injection markers. The local backend is written in pure Rust and can be run via the command line to serve the desktop application.