Loading HoneyMesh...
Loading HoneyMesh...
Technical architecture
Node Guard protects an application locally. HoneyMesh handles separately authorized host enforcement. This separation gives administrators a place to inspect scope, grant ownership, expiry, and rollback before a packet rule changes.
Request path
The optional bridge connects an application to the host path. A standalone Node Guard installation stops at the first layer.
01 / Node Guard Free is public
A Node.js service supplies source and identity context it has verified. Local policy can observe, throttle, or deny requests within that process.
No root access or HoneyMesh host agent is required for the free SDK.
02 / Node Pro paid pilot
A registered application can send an authenticated observation or bounded request to a local HoneyMesh agent.
The app does not write kernel maps. Its Linux identity, secret, app ID, and entitlement are checked separately.
03 / Scoped host beta
The agent evaluates the request, owns grant identity and expiry, reconciles overlapping owners, and records the reason for a decision.
Browser controls and application events request defined actions; neither receives arbitrary host shell access.
04 / Qualified generic-XDP path
On explicitly selected Linux interfaces, an authorized grant can drop ingress packets from an exact source IP.
Coverage is limited to the attached interface, address family, and tested policy. It is not a general stateful firewall.
One scoped decision
A verified application event, configured trap, or deliberate operator action identifies a source and reason.
The local agent checks mode, identity, protected scope, grant owner, and bounded lifetime. The operator can inspect and release a grant.
Only an authorized host path may apply an exact-source ingress XDP block on an attached interface.
The published Node Guard Free alpha has process-local state. The host path requires a separately licensed, signed agent and an installation that supports the scoped contract.
| Boundary | Control | Current scope |
|---|---|---|
| Application → agent | Local authenticated bridge with separate app identity and scoped authorization | Node Pro pilot; the free SDK remains independent |
| Console → agent | Local account and bounded host-action endpoints; management stays on loopback | Agent and console are paired in signed host candidates |
| Agent → kernel | Agent-owned grant validation, selected interface, expiry, and release | Exact-source generic-XDP beta scope |
| Host → Exchange | Opt-in trust and authenticated observations; each receiving node decides locally | Separate private pilot; distributed lifecycle is not generally qualified |
| Customer → Network Decode | Payment and license delivery use billing identity; local traffic data is not part of the purchase flow | See privacy and pilot terms for the current service boundary |
The tested host profile is a noncritical Ubuntu 24.04 AMD64 machine with generic XDP, a selected network interface, and a separate provider recovery path. XDP sees ingress packets before application TLS termination; it cannot inspect decrypted HTTP request content.
Review Firewall Beta scopeOptional Exchange and trusted peers are not required for local protection. Distributed retraction, outage recovery, and tenant isolation need their own end-to-end qualification before general release.
Review Exchange status