AgentGuard sits on the wire between your agent and everything it touches — deciding, in policy, what reaches your shell, your APIs, your customers. Enforcement at the protocol boundary, not an SDK the agent can opt out of. Open core. Self-hosted. Built so a hijacked prompt never becomes a hijacked production system.
Put the firewall on the wire — at the protocol boundary between the agent and the world. Define policy. Stream the audit. Self-hosted by default — we never see your traffic.
Point your MCP client at the gateway, or set one base-URL env var so OpenAI / Anthropic SDK traffic flows through the proxy. Every tool call is now policy-checked — including dynamic and model-generated ones.
# agentguard-llm-proxy export OPENAI_BASE_URL=http://127.0.0.1:8081/v1
Rules in YAML across seven scopes — shell, filesystem, network, browser, cost, data, MCP tools. Allow, deny, or pause for human approval; rate limits and spend caps compose on top.
scope: shell deny: "rm -rf *" · require_approval: "sudo *"
Append-only JSONL trail — agent, scope, command, reasoning. Query it by CLI, dashboard, or Prometheus; forward it to WORM storage or your SIEM for tamper evidence. Replay any run end-to-end.
# 14:02:11.482 shell → DENY · audit #4821 · 0.53 ms
The agent issues a tool call; the checkpoint evaluates policy; the call proceeds, pauses for human approval, or is denied. One policy, one audit trail, one approval queue — whether the checkpoint runs as an MCP gateway, an LLM API proxy, or in front of your SDK.
intent agent
Policy evaluated at the protocol boundary — 0.53 ms p99, measured. One decision per call. Append-only, replayable audit.
real systems
Run it on the wire for zero code changes, or embed the SDK where the wire isn’t practical. Same policy engine, same audit trail, same approval queue on every path.
JSON-RPC checkpoint between any MCP client — Claude Desktop, Cursor, Cline, Continue, Zed — and the real MCP server. Every tools/call is policy-checked before it reaches the server. No agent code changes.
HTTP checkpoint in front of the OpenAI and Anthropic APIs — set one base-URL env var. Tool calls in the response stream are gated against policy, with streaming support.
The SDKs are opt-in by design — the agent calls guard.check(…). Use them when you control the agent’s source; pair them with the wire-level paths when you don’t.
We took out the things you don’t want in your security path: an outbound dependency, a vendor with your prompts, a black-box decision. AgentGuard is yours — on your wire, in your infrastructure.
Single binary or library. Runs in your VPC, your container, your laptop. There is no SaaS to call.
By default, prompts, tool args, and results never leave your network — the runtime makes no outbound calls. If you opt in to the hosted dashboard, you choose what gets sent.
Every decision written to an append-only JSONL trail — agent, scope, command, reasoning. Forward it to S3 Object Lock, a SIEM, or syslog for tamper evidence. Reconstruct any run end-to-end.
YAML with a stable v1 schema across seven scopes — shell, filesystem, network, browser, cost, data, MCP tools. Reviewable in PRs. Versioned, diff-able, deployable like any service.
Measured end-to-end on the full check path with persistence enabled, and gated in CI against a 3 ms budget. Fast enough to sit in front of every tool call.
The runtime, approval queue, and dashboard are Apache 2.0 and stay that way. AgentGuard Cloud is a paid layer on top — it never gates the open path.
The full firewall is open source — install, configure, self-host. AgentGuard Cloud is the hosted, multi-tenant version: same policy engine, same audit trail, run for you. Currently in design; the waitlist is open.
The full firewall — wire-level transports, policy engine, approvals, dashboard. Apache 2.0, source on GitHub. You write the YAML, you run the binary, you keep every byte.
Same engine, run for you. Central control plane for teams running multiple agents in production — shared policy libraries, global rate limits, and a managed audit trail if you want one.
The claims below track the open-source repo — when the code changes, this page changes.
Yes. The full runtime — policy engine, wire-level transports, approval queue, and dashboard — is Apache 2.0, source on GitHub. Self-hosted, single binary. AgentGuard Cloud is a separate hosted layer that never gates the open path.
AgentGuard intercepts at the protocol boundary instead of asking the agent to opt in. The MCP gateway sits between any MCP client (Claude Desktop, Cursor, Cline, Continue, Zed) and the real MCP server, policy-checking every tools/call. The LLM API proxy sits in front of the OpenAI and Anthropic APIs — set one base-URL environment variable and tool calls in the response stream are gated before your code ever sees them.
No. AgentGuard is self-hosted and makes no outbound calls by default. Prompts, tool arguments, and results stay in your network unless you configure notifications (Slack, webhooks) or opt in to AgentGuard Cloud.
0.53 ms p99, measured end-to-end on the full HTTP check path with persistence enabled. A CI gate fails the build if p99 crosses the 3 ms budget.
Yes, since v1.0. The zero-config default is single-node SQLite; point --store-dsn at PostgreSQL and give each replica a --node-id to share approval, rate-limit, and cost state across nodes. Reconciliation runs in the background — no synchronous database call is added to the /v1/check hot path, so the sub-3 ms p99 budget is preserved. Distributed rate limiting is bounded-overshoot by design, and conflicting approval resolutions always converge to DENY.
AgentGuard writes an append-only JSON-Lines audit trail of every decision — agent, scope, command, reasoning. It does not cryptographically seal the log itself; for tamper evidence, forward the trail to append-only/WORM storage such as S3 Object Lock, a SIEM, or syslog.
No. AgentGuard is a policy-enforcement and audit layer, not an OS sandbox — it does not intercept syscalls. Combine it with OS-level isolation (containers, seccomp, egress rules) when your threat model includes a hostile agent that controls its own runtime.
Built in public. Shipped against a thesis, not a press release.
policy precedes action · lex antecedit actum
Reviewed. Versioned. Auditable. Get on the waitlist for early access — design partners go first, OSS ships free, forever.