GemGuard collects system information — running processes, network connections, and recently installed packages — and then uses Google’s Gemini models to generate a human-readable assessment of anything that might look suspicious or worth checking.
The tool is cross-platform and works on: Linux (Fedora, Ubuntu/Debian, Kali, Alpine) and Windows 10/11
It offers both a CLI and a Textual-based TUI, supports multiple Gemini models, and includes a quiet mode for automation or integration with other tools.
Features include: - Process auditing - Package review (auto-detects package manager) - Network/port inspection - Optional raw AI output (quiet mode) - Works in Bash/Zsh/CMD/PowerShell
I’m not a security expert, so the project is experimental, and contributions or feedback are very welcome.