### Diagnose Daemon Startup Failures

Source: https://github.com/dedsecorg/agentic-route/wiki/Troubleshooting

Commands to inspect logs, install dependencies, and clean up stale FIFO files when the daemon fails to start.

```bash
# Check logs
journalctl -u agentic-route-daemon -n 50 --no-pager

# Common issues:
# 1. inotify-tools not installed
sudo -S -p '' apt-get install inotify-tools

# 2. Missing CAP_NET_ADMIN
# Check service file has:
# CapabilityBoundingSet=CAP_NET_ADMIN
# AmbientCapabilities=CAP_NET_ADMIN

# 3. FIFO cleanup from previous crash
ls -la /run/agentic-route/
# Remove stale FIFO if needed:
rm -f /run/agentic-route/events.fifo
```

--------------------------------

### Manual Installation via Git

Source: https://github.com/dedsecorg/agentic-route/wiki/Installation

Clones the repository and executes the installation script with sudo privileges.

```bash
git clone https://github.com/dedsecorg/agentic-route
cd agentic-route
sudo -S -p '' ./install.sh
```

--------------------------------

### Install via Smithery

Source: https://github.com/dedsecorg/agentic-route/wiki/Installation

Installs the package using the Smithery CLI for MCP clients.

```bash
npx -y @smithery/cli install @dedsecorg/agentic-route
```

--------------------------------

### WireGuard VPN Configuration Example

Source: https://github.com/dedsecorg/agentic-route/wiki/Architecture

Example configuration snippet for adding a WireGuard VPN to the intent file.

```json
{
  "pinned_routes": [
    {"priority": 500, "table": 500, "dest": "0.0.0.0/0", "via": "10.8.0.1", "comment": "WireGuard egress"}
  ],
  "forbidden_rules": [
    {"priority": 501, "comment": "WireGuard auto-readd"}
  ]
}
```

--------------------------------

### MCP Example Session

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/MCP-Integration.md

Example JSON-RPC exchange between a client and the server for initialization and tool invocation.

```json
// Client -> Server
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}

// Server -> Client
{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{"route_status":{...},"route_check":{...},"route_diff":{...},"route_trace":{...}}},"serverInfo":{"name":"agentic-route","version":"1.1.0"}}}

// Client -> Server
{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"route_status","arguments":{}}}

// Server -> Client
{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"agentic-route status
Spec: /etc/agentic-route/routes.json

--- Desired rules ---
  480: from all to 100.64.0.0/10 lookup 52
..."}]}}
```

--------------------------------

### API Request Examples

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/REST-API.md

Examples of using curl to interact with the API endpoints for drift checking, status retrieval, and reconciliation.

```bash
# Check drift
curl http://localhost:8099/api/v1/check
# {"clean": false}

# Get full status
curl http://localhost:8099/api/v1/status
# {"status": "ok", "text": "agentic-route status
Spec: /etc/agentic-route/routes.json
--- Desired rules ---
..."}

# Enforce reconciliation
curl http://localhost:8099/api/v1/enforce
# {"enforced": true}
```

--------------------------------

### Example intent.json Configuration

Source: https://github.com/dedsecorg/agentic-route/wiki/Architecture

A sample configuration defining forbidden rules and pinned routes for various VPN services.

```json
{
  "forbidden_rules": [
    {"priority": 31580, "comment": "ProtonVPN catch-all"},
    {"priority": 31581, "comment": "ProtonVPN split-tunnel re-add"}
  ],
  "pinned_routes": [
    {"priority": 480, "table": 52, "dest": "100.64.0.0/10", "comment": "Tailscale"},
    {"priority": 32765, "table": 205, "dest": "0.0.0.0/0", "comment": "NordVPN egress"},
    {"priority": 100, "table": 100, "dest": "10.2.0.0/24", "via": "10.2.0.1", "comment": "ProtonVPN DNS"}
  ]
}
```

--------------------------------

### Start the MCP Server

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/MCP-Integration.md

Command to run the read-only stdio JSON-RPC 2.0 server.

```bash
agentic-route mcp
```

--------------------------------

### Start the API Server

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/REST-API.md

Starts the API server, which listens on port 8099 by default. The port can be configured using the AGENTIC_ROUTE_API_PORT environment variable.

```bash
agentic-route api
# Listens on port 8099 (configurable via AGENTIC_ROUTE_API_PORT)
```

--------------------------------

### Enable Daemon Service

Source: https://github.com/dedsecorg/agentic-route/wiki/Installation

Enables and starts the agentic-route-daemon systemd service immediately.

```bash
sudo -S -p '' systemctl enable --now agentic-route-daemon
```

--------------------------------

### Forbidden Rules Priority Gating Example

Source: https://github.com/dedsecorg/agentic-route/wiki/Intent-File

An example showing how to use the prio field to ensure only specific rules at a given priority are deleted.

```json
{ "prio": 31581, "match": "lookup 245447468" }
```

--------------------------------

### GET /api/v1/check

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/REST-API.md

Performs drift detection to verify if the current state matches the desired configuration.

```APIDOC
## GET /api/v1/check

### Description
Checks for configuration drift and returns whether the system state is clean.

### Method
GET

### Endpoint
/api/v1/check

### Response
#### Success Response (200)
- **clean** (boolean) - Indicates if the system is in a clean state (true) or has drift (false).
```

--------------------------------

### State File JSON Structure

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/Architecture.md

Example of the state file generated by the daemon, containing discovered kernel state and reconciliation metadata.

```json
{
  "discovered_rules": [...],
  "discovered_routes": [...],
  "last_reconcile": "2026-09-04T14:29:22Z",
  "drift_corrected": 0
}
```

--------------------------------

### GET /api/v1/enforce

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/REST-API.md

Triggers the reconciliation process to apply desired configurations.

```APIDOC
## GET /api/v1/enforce

### Description
Applies the reconciliation process to ensure the system matches the desired state.

### Method
GET

### Endpoint
/api/v1/enforce

### Response
#### Success Response (200)
- **enforced** (boolean) - Confirmation that the enforcement process was triggered.
```

--------------------------------

### GET /api/v1/diff

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/REST-API.md

Retrieves a precise diff of the current configuration versus the desired state.

```APIDOC
## GET /api/v1/diff

### Description
Returns a precise diff of the configuration, equivalent to the CLI diff command.

### Method
GET

### Endpoint
/api/v1/diff
```

--------------------------------

### GET /api/v1/status

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/REST-API.md

Retrieves the full service status, including live status and desired rules/routes.

```APIDOC
## GET /api/v1/status

### Description
Returns the full service status, including the current configuration file path and the list of desired rules.

### Method
GET

### Endpoint
/api/v1/status

### Response
#### Success Response (200)
- **status** (string) - The status of the service (e.g., "ok").
- **text** (string) - Detailed status information including spec path and rules.
```

--------------------------------

### GET /api/v1/status

Source: https://github.com/dedsecorg/agentic-route/wiki/REST-API

Retrieves the full service status, including the location of the specification file and the current desired rules.

```APIDOC
## GET /api/v1/status

### Description
Returns the full service status, including the path to the routes specification and the current desired rules.

### Method
GET

### Endpoint
/api/v1/status

### Response
#### Success Response (200)
- **status** (string) - The status of the service.
- **text** (string) - Detailed status information including spec path and rules.
```

--------------------------------

### Configure MCP client manifest

Source: https://github.com/dedsecorg/agentic-route/blob/master/docs/MCP_GUIDE.md

Path to the MCP server configuration file required for Cursor, Windsurf, Copilot, and Hermes Agent.

```text
mcp/mcp_server.json
```

--------------------------------

### API Implementation Logic

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/REST-API.md

The server implementation uses socat for TCP listening and a handler function to route requests to the appropriate CLI subcommands.

```bash
cmd_api() {
    local port="${AGENTIC_ROUTE_API_PORT:-8099}"
    if ! command -v socat >/dev/null 2>&1; then
        ar_die "socat is required for api"
    fi
    ar_log "API listening on :$port"
    while true; do
        socat TCP-LISTEN:"$port",reuseaddr,fork SYSTEM:"$0 api-handler" 2>/dev/null
    done
}

cmd_api_handler() {
    local path
    IFS=' ' read -r _ path _ || true
    printf 'HTTP/1.1 200 OK
Content-Type: application/json

'
    case "$path" in
        /api/v1/status) cmd_status 2>&1 | jq -Rs '{status:"ok", text:.}';;
        /api/v1/check) cmd_check >/dev/null 2>&1; printf '{"clean":%s}
' "$([ "$?" -eq 0 ] && echo true || echo false)";;
        /api/v1/enforce) cmd_enforce >/dev/null 2>&1; echo '{"enforced":true}';;
        *) echo '{"error":"not found"}';;
    esac
}
```

--------------------------------

### Claude Desktop Configuration

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/MCP-Integration.md

Configuration snippet to add agentic-route as an MCP server in Claude Desktop.

```json
{
  "mcpServers": {
    "agentic-route": {
      "command": "agentic-route",
      "args": ["mcp"]
    }
  }
}
```

--------------------------------

### Running agentic-route in Agent Sandboxes

Source: https://github.com/dedsecorg/agentic-route/blob/master/README.md

Commands to execute the container with required NET_ADMIN capabilities and host network access for status queries or daemon mode operation.

```bash
# Query routing state and status
docker run --rm \
  --cap-add=NET_ADMIN \
  --network=host \
  ghcr.io/dedsecorg/agentic-route:v1 status

# Run the reconciliation loop in daemon mode
docker run -d \
  --name agentic-route \
  --restart unless-stopped \
  --cap-add=NET_ADMIN \
  --network=host \
  -v /etc/hermes-route:/etc/hermes-route \
  ghcr.io/dedsecorg/agentic-route:v1 daemon
```

--------------------------------

### Run Daemon and Reconcile in Debug Mode

Source: https://github.com/dedsecorg/agentic-route/wiki/Troubleshooting

Commands to execute the daemon or reconciliation process in the foreground with verbose output enabled.

```bash
# Run daemon in foreground with verbose output
HR_QUIET=0 /usr/local/bin/hermes-route-daemon

# Or run reconcile with debug
HR_QUIET=0 HR_DIFF_MODE=check /usr/local/bin/agentic-route-reconcile
```

--------------------------------

### Edit Intent File via CLI

Source: https://github.com/dedsecorg/agentic-route/wiki/Architecture

Command to open the intent configuration file for editing.

```bash
# Edit the intent file
vim /etc/agentic-route/intent.json
```

--------------------------------

### Run local validation commands

Source: https://github.com/dedsecorg/agentic-route/blob/master/CONTRIBUTING.md

Execute these commands to validate the project locally before submitting changes.

```bash
bash -n bin/agentic-route
./tests/test_cli.sh
npm pack --dry-run
```

--------------------------------

### Kubernetes Controller Pattern Logic

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/Architecture.md

Conceptual flow of the reconciliation process comparing observed kernel state against user intent.

```text
Observed (kernel) + Intent (/etc/.../intent.json)
  -> Compute Delta
  -> Apply (surgical ip rule/route)
  -> Emit Status (/run/.../state.json)
```

--------------------------------

### Security Audit Commands

Source: https://github.com/dedsecorg/agentic-route/wiki/Security-Hardening

Commands to verify the applied security hardening, including capability checks, systemd property inspection, and file permission validation.

```bash
# Verify capabilities
getcap /usr/local/bin/agentic-route-daemon
# Should show: =ep cap_net_admin+ep

# Verify systemd hardening
systemctl show agentic-route-daemon --property=CapabilityBoundingSet,AmbientCapabilities,ProtectSystem,ReadWritePaths,NoNewPrivileges

# Verify file permissions
ls -la /usr/local/bin/agentic-route* /usr/local/lib/agentic-route/
ls -la /etc/agentic-route/
ls -la /run/agentic-route/
```

--------------------------------

### MCP Tool: route_status

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/MCP-Integration.md

Retrieves the current live and desired kernel rules and routes.

```APIDOC
## tools/call: route_status

### Description
Returns the live and desired kernel rules and routes in a read-only format.

### Parameters
- **arguments** (object) - Required - Empty object `{}`
```

--------------------------------

### Bypass failing upstream resolver

Source: https://github.com/dedsecorg/agentic-route/blob/master/skills/agentic-route/SKILL.md

Use this command to bypass a failing resolver and prioritize a backup server.

```bash
agentic-route bypass stubby unbound
```

--------------------------------

### FIFO Multiplexing Implementation

Source: https://github.com/dedsecorg/agentic-route/wiki/Daemon-Internals

A bash script that sets up a FIFO pipe to aggregate events from inotifywait and ip monitor, using a debounced loop to process changes.

```bash
#!/usr/bin/env bash
set -eo pipefail

RUN_DIR="/run/agentic-route"
FIFO="$RUN_DIR/events.fifo"
INTENT_DIR="/etc/agentic-route"
RECONCILE_BIN="/usr/local/bin/agentic-route-reconcile"

mkdir -p "$RUN_DIR" "$INTENT_DIR"
[[ -p "$FIFO" ]] || mkfifo "$FIFO"

# Cleanup on exit
trap 'exec 3>&-; kill $(jobs -p) 2>/dev/null; rm -f "$FIFO"' EXIT INT TERM

# Stream 1: Intent file changes (directory watch survives vim atomic rename)
inotifywait -m -q -e close_write,moved_to --format '%f' "$INTENT_DIR/" > "$FIFO" 2>/dev/null &

# Stream 2: Kernel routing changes (Netlink)
ip monitor rule route link 2>/dev/null > "$FIFO" &

# Hold FIFO open on FD 3 so it never receives EOF when writers restart
exec 3<> "$FIFO"

# Unified debounced loop reading strictly from FD 3
while read -r event <&3; do
  # Drain burst events (200ms window)
  while read -r -t 0.2 -u 3 _; do :; done
  
  case "$event" in
    intent.json|*.json)
      log "intent file changed: $event"
      ;;
    *)
      log "kernel routing event"
      ;;
  esac
  
  if "$RECONCILE_BIN"; then
    :  # clean, no drift
  else
    log "drift corrected"
  fi
done
```

--------------------------------

### Shared Infrastructure Architecture Diagram

Source: https://github.com/dedsecorg/agentic-route/wiki/agentic-dns

Visual representation of the relationship between agentic-route and agentic-dns within the Linux kernel environment.

```text
+------------------+     +------------------+
|  agentic-route   |     |  agentic-dns     |
|  (L3 routing)    |     |  (L7 DNS)        |
+--------+---------+     +--------+---------+
         |
         |  Tailscale mesh       |  Pi-hole blocking
         |  NordVPN egress       |  CoreDNS split-horizon
         |  ProtonVPN DNS        |  dnsdist load balance
         v                       v
+----------------------------------------------+
|           Linux Kernel                       |
|  ip rule/route + nftables/iptables           |
+----------------------------------------------+
```

--------------------------------

### Systemd Unit Hardening Configuration

Source: https://github.com/dedsecorg/agentic-route/wiki/Security-Hardening

Configuration for the agentic-route-daemon.service to enforce security constraints such as capability restrictions, read-only system paths, and prevention of privilege escalation.

```ini
[Service]
Type=simple
ExecStart=/usr/local/bin/agentic-route-daemon
Restart=always
RestartSec=2
CapabilityBoundingSet=CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN
ProtectSystem=strict
ReadWritePaths=/run/agentic-route /etc/agentic-route
NoNewPrivileges=yes
```

--------------------------------

### MCP Tool: route_diff

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/MCP-Integration.md

Provides a precise diff between the specification and the live state.

```APIDOC
## tools/call: route_diff

### Description
Returns a list of rules to add, forbidden rules to remove, and pinned routes to replace.

### Parameters
- **arguments** (object) - Required - Empty object `{}`
```

--------------------------------

### Intent File Schema

Source: https://github.com/dedsecorg/agentic-route/wiki/Intent-File

The full structure of the /etc/agentic-route/intent.json file, including forbidden_rules, pinned_routes, and custom_rules.

```json
{
  "version": 1,
  "comment": "User intent only. Daemon writes discovered state to /run/agentic-route/state.json.",
  "forbidden_rules": [
    { "prio": 31580, "match": "suppress_prefixlength 0", "reason": "Remove VPN capture rule at this priority" },
    { "match": "100.64.0.0/10 lookup main", "reason": "Never let VPN redirect mesh CIDR through main table" }
  ],
  "pinned_routes": [
    { "dst": "198.51.100.7/32", "via": "192.0.2.1", "dev": "eth0", "reason": "Keep VPN endpoint reachable outside tunnel" },
    { "dst": "default", "via": "192.0.2.1", "dev": "eth0", "reason": "Bare-metal fallback egress" }
  ],
  "custom_rules": [
    { "prio": 480, "selector": "from all to 100.64.0.0/10", "action": "lookup 52" },
    { "prio": 32765, "selector": "not from all fwmark 0xe1f1", "action": "lookup 205" }
  ]
}
```

--------------------------------

### Configure Multi-VPN routing with intent.json

Source: https://github.com/dedsecorg/agentic-route/wiki/Multi-VPN-Example

Defines forbidden rules, pinned routes, and custom routing rules to manage traffic across NordVPN, ProtonVPN, and Tailscale.

```json
{
  "version": 1,
  "comment": "Multi-VPN stack: NordVPN egress, ProtonVPN DNS, Tailscale mesh",
  "forbidden_rules": [
    { "prio": 31580, "match": "suppress_prefixlength 0", "reason": "Proton suppress-bypass rule (ride-along with its capture)" },
    { "prio": 31581, "match": "lookup 245447468", "reason": "Proton split-tunnel capture: Proton is DNS-only, must not own host egress" },
    { "match": "100.64.0.0/10 lookup main", "reason": "Tailscale hijack: mesh CIDR must never route via main table" }
  ],
  "pinned_routes": [
    { "dst": "194.126.177.6/32", "via": "185.170.112.1", "dev": "eth0", "reason": "Pin Proton WG endpoint through eth0 so tunnel never loses handshake" },
    { "dst": "10.2.0.1/32", "dev": "proton0", "comment": "Proton DNS resolver strictly out proton0" },
    { "dst": "default", "via": "185.170.112.1", "dev": "eth0", "comment": "Bare-metal fallback egress (never let VPNs remove it)" }
  ],
  "custom_rules": [
    { "prio": 480, "selector": "from all to 100.64.0.0/10", "action": "lookup 52" },
    { "prio": 32765, "selector": "not from all fwmark 0xe1f1", "action": "lookup 205" }
  ]
}
```

--------------------------------

### Analyze High CPU Usage

Source: https://github.com/dedsecorg/agentic-route/wiki/Troubleshooting

Commands to monitor CPU usage of the daemon and check for rapid event loops in the logs.

```bash
# Check if debounce is working
# Should see ~0% CPU idle, spikes only on events
top -p $(systemctl show agentic-route-daemon --property=MainPID --value)

# If high CPU: check for runaway loop
journalctl -u agentic-route-daemon -f
# Look for rapid "kernel routing event" logs without debounce
```

--------------------------------

### Diagnose routing connectivity outage

Source: https://github.com/dedsecorg/agentic-route/blob/master/skills/agentic-route/SKILL.md

Run these commands sequentially to check service status, perform a health sweep, and trace packets for a specific domain.

```bash
agentic-route status
agentic-route health
agentic-route trace google.com
```

--------------------------------

### MCP Tool: route_trace

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/MCP-Integration.md

Traces the routing path for a packet to a target IP address.

```APIDOC
## tools/call: route_trace

### Description
Simulates and traces how a packet to a target IP would route, optionally specifying a source IP.

### Parameters
- **target** (string) - Required - The destination IP address.
- **source** (string) - Optional - The source IP address.
```

--------------------------------

### High-Level Architecture Flow

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/Architecture.md

Visual representation of the event-driven reconciliation loop involving inotify, FIFO multiplexing, and kernel routing updates.

```text
+---------------------+     inotifywait      +------------------+
|  /etc/agentic-route/|<---------------------|  intent.json     |
|  (directory watch)  |   (survives vim)     |  (user intent)   |
+----------+----------+                      +------------------+
           |                                      ^
           | events                               | edit
           v                                      |
+---------------------+     ip monitor           |
|   FIFO multiplexer  |<--------------------------+
|  (exec 3<> "$FIFO") |   kernel Netlink
+----------+----------+
           | 200ms debounce
           v
+---------------------+
|  reconcile binary   |
|  (idempotent)       |
+----------+----------+
           | surgical ip rule/route
           v
+---------------------+
|  Kernel routing     |
|  tables + rules     |
+---------------------+
```

--------------------------------

### Pulling the agentic-route OCI Image

Source: https://github.com/dedsecorg/agentic-route/blob/master/README.md

Commands to pull specific versions or the latest build of the agentic-route container image from GHCR.

```bash
# Pinned release (recommended for deterministic CI / sandboxes)
docker pull ghcr.io/dedsecorg/agentic-route:1.0.0

# Moving major release (auto-receives non-breaking fixes)
docker pull ghcr.io/dedsecorg/agentic-route:v1

# Latest build from default branch
docker pull ghcr.io/dedsecorg/agentic-route:latest
```

--------------------------------

### Debug Drift Correction Issues

Source: https://github.com/dedsecorg/agentic-route/wiki/Troubleshooting

Commands to manually trigger reconciliation and inspect the state and intent JSON files.

```bash
# Run one-shot to see output
agentic-route-reconcile

# Check state
cat /run/agentic-route/state.json | jq .

# Verify intent.json is valid JSON
jq . /etc/agentic-route/intent.json
```

--------------------------------

### MCP Tools

Source: https://github.com/dedsecorg/agentic-route/wiki/MCP-Integration

The following tools are exposed via the MCP server for inspection and diagnostic purposes.

```APIDOC
## MCP Tools

### route_status
- **Description**: Show live and desired kernel rules and routes.
- **Input**: {}

### route_check
- **Description**: Report whether routing has drifted from the spec.
- **Input**: {}

### route_diff
- **Description**: Precise diff of spec vs live: rules to add, forbidden rules to remove, pinned routes to replace.
- **Input**: {}

### route_trace
- **Description**: Trace how a packet to a target IP would route, optionally from a source IP.
- **Input**: {"target": "string", "source": "string" (optional)}
```

--------------------------------

### Run agentic-route diff

Source: https://github.com/dedsecorg/agentic-route/wiki/Commands

Performs a read-only comparison to identify specific additions, deletions, or replacements required to match the desired state.

```bash
$ agentic-route diff
agentic-route diff
Spec: /etc/agentic-route/routes.json

--- rules missing from live (would-add) ---
  + 480  from all to 100.64.0.0/10 lookup 52

--- forbidden rules present (would-del) ---
  - 31581  from all lookup 245447468

--- pinned routes missing (would-replace) ---
  ~ 198.51.100.7/32 via 192.0.2.1 dev eth0
```

--------------------------------

### Add agentic-route to Claude Code

Source: https://github.com/dedsecorg/agentic-route/blob/master/docs/MCP_GUIDE.md

Command to register the agentic-route MCP server with Claude Code.

```bash
claude mcp add agentic-route agentic-route mcp
```

--------------------------------

### Resolve VPN Routing Breaks

Source: https://github.com/dedsecorg/agentic-route/wiki/Troubleshooting

Commands to force a reconciliation or restart the daemon if routing is not automatically corrected after a VPN reconnect.

```bash
# Force reconcile
agentic-route enforce

# Or restart daemon
systemctl restart agentic-route-daemon
```

--------------------------------

### Check agentic-route status

Source: https://github.com/dedsecorg/agentic-route/wiki/Commands

Displays the current drift between the desired configuration in /etc/agentic-route/routes.json and the live IPv4 rules and routes.

```bash
$ agentic-route status
agentic-route status
Spec: /etc/agentic-route/routes.json

--- Desired rules ---
  480: from all to 100.64.0.0/10 lookup 52
  32765: not from all fwmark 0xe1f1 lookup 205

--- Live IPv4 rules ---
  0: from all lookup local
  100: from 192.0.2.10 lookup wan
  480: from all to 100.64.0.0/10 lookup 52
  32765: not from all fwmark 0xe1f1 lookup 205
  32766: from all lookup main
  32767: from all lookup default

--- Desired pinned routes ---
  198.51.100.7/32 via 192.0.2.1 dev eth0
  default via 192.0.2.1 dev eth0

--- Live IPv4 routes ---
  default via 192.0.2.1 dev eth0
  198.51.100.7 via 192.0.2.1 dev eth0

--- Drift ---
agentic-route diff
Spec: /etc/agentic-route/routes.json

--- rules missing from live (would-add) ---
--- forbidden rules present (would-del) ---
--- pinned routes missing (would-replace) ---
(read-only: run 'agentic-route enforce' to apply)
```

--------------------------------

### MCP Tool: route_check

Source: https://github.com/dedsecorg/agentic-route/blob/master/wiki/MCP-Integration.md

Reports whether the current routing configuration has drifted from the defined specification.

```APIDOC
## tools/call: route_check

### Description
Checks for configuration drift between the spec and the live kernel state.

### Parameters
- **arguments** (object) - Required - Empty object `{}`
```

--------------------------------

### Maintainer PGP Public Key

Source: https://github.com/dedsecorg/agentic-route/blob/master/SECURITY.md

Use this PGP public key to encrypt sensitive security reports before submission.

```text
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEZk3VYhYJKwYBBAHaRw8BAQdAQhJg9T9/3s9+2t3+3t3+3t3+3t3+3t3+3t3
+3t3+3t30A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0
-----END PGP PUBLIC KEY BLOCK-----
```

--------------------------------

### Signal Handling Trap

Source: https://github.com/dedsecorg/agentic-route/wiki/Daemon-Internals

The trap command used to clean up file descriptors, terminate background jobs, and remove the FIFO pipe upon daemon exit.

```bash
trap 'exec 3>&-; kill $(jobs -p) 2>/dev/null; rm -f "$FIFO"' EXIT INT TERM
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.