# Garnet — Runtime evidence for untrusted execution

> Runtime evidence for untrusted execution. Garnet records every process, network call, and file touch from your CI runs, coding agents, and sandboxes so teams see what actually ran in the kernel.

## Product overview
- Garnet provides runtime visibility for GitHub workflows by profiling process, network, and file behavior with a kernel-level eBPF sensor (Jibril).
- Every run produces a structured profile with execution lineage and behavioral assertions so teams can review what code actually did.
- Results are delivered where engineering teams already work: pull requests, GitHub summaries, Slack, and the Garnet app.

## Core capabilities
- Runtime profiling for process trees, outbound connections, and file activity in CI.
- Behavioral assertions to detect suspicious lineage and known-bad egress.
- GitHub-native feedback in summaries and PR comments for each run (Garnet Runtime Review).
- Shareable public run reports: every published run has a logged-out permalink at https://app.garnet.ai/public/runs/<run-id>?profile=<profile-id> (the exact profile selector is required).
- Managed threat intelligence for known-bad domains and actionable blocking decisions.
- Historical run profiles and incident investigations in the Garnet app.

## Pricing
- Open source: free and unlimited runs on public repositories (community support).
- Pay as you go: usage-based — 500 runs per month free, then $0.50 per run.
- A run is one CI job that produces a Run Profile.
- Unlimited members and repositories on every plan; no per-seat or per-repo charges.
- Enterprise: volume discounts at 10,000+ runs/month, committed-use pricing, SSO/SAML, self-hosting.

## Proof points
- Built by creators of Tetragon and Tracee.
- Runtime Records publishes runtime visibility field notes from real supply-chain and CI incidents.
- Designed for modern development teams adopting AI-generated code and third-party automation.

## Official URLs
- Marketing site: https://www.garnet.ai/
- Documentation: https://docs.garnet.ai
- App: https://app.garnet.ai
- Pricing: https://www.garnet.ai/pricing
- Company: https://www.garnet.ai/about
- Resources & articles: https://www.garnet.ai/resources
- Trust Center: https://app.vanta.com/garnet.ai/trust/i63921ahbwt5v5ytju14n0
- Legacy /blog URLs permanently redirect to /resources (same slug under /resources/[slug]).

## Install (GitHub Actions)
Prefer a **pinned commit SHA** from the latest release (floating `@v2` / `@v2.1.x` tags can move):
- Pinned SHA manifest: https://www.garnet.ai/pins.txt
- Human-readable: https://www.garnet.ai/pins
```yaml
- uses: garnet-org/action@<COMMIT_SHA_FROM_PINS.txt>
  with:
    api_token: ${{ secrets.GARNET_API_TOKEN }}
```
(Quick start only, not for production pinning: `garnet-org/action@v2`.)

## Keywords
runtime visibility, eBPF, run profile, runtime assertions, supply chain security, AI-generated code, GitHub Actions, CI security, egress monitoring, behavioral detection

## Contact & social
- X: https://x.com/garnet_labs
- GitHub org: https://github.com/garnet-org
- LinkedIn: https://www.linkedin.com/company/garnetlabs

## Machine-readable discovery
- Sitemap: https://www.garnet.ai/sitemap.xml
- Garnet Action pin (SHA): https://www.garnet.ai/pins.txt
- This file: https://www.garnet.ai/llms.txt