AgentGuard

Overview

AgentGuard is an enterprise security runtime for AI agent systems, purpose-built around the OWASP Agentic AI Top 10 v2.1 categories. It launched October 10, 2026 (138 HN points) as the first runtime that treats the OWASP categories as a first-class concern at the agent hot path, not as an after-the-fact audit checklist.

AgentGuard sits between agent frameworks and the underlying infrastructure — it intercepts tool calls, validates them against policy, logs them, and enforces runtime constraints. It's closer to a service mesh for agent traffic than a traditional security tool, and it integrates with Claude, OpenAI, Gemini, LangGraph, CrewAI, and AutoGen without framework-specific code.

The runtime enforces the v2.1 categories directly:

• A01 Prompt Injection — input and tool-output sanitization
• A02 Insecure Output Handling — schema-validated tool results
• A03 Supply Chain Vulnerabilities — signed skill verification, signed MCP server registration
• A04 Data Leakage — DLP across agent I/O
• A05 Privacy Violations — PII detection and redaction
• A06 Prompt Injection via Tool Output — adversarial content detection on tool results
• A07 Agent Privilege Escalation — least-privilege tool access per agent identity
• A08 Memory Poisoning — write-verification on agent memory stores
• A09 Cross-Agent Coordination Attacks — multi-agent policy enforcement
• A10 Tool-Level Data Leakage — tool-output exfiltration detection

Features

• OWASP v2.1 compliance built-in — all 10 categories addressed at runtime
• Framework-agnostic — integrates with Claude, OpenAI, Gemini, LangGraph, CrewAI, AutoGen, and custom frameworks through SDK proxies
• Property-based runtime verification — encodes safety invariants as checks evaluated on every agent action (inspired by OpenShell 2.0)
• Per-agent policy — different policies per agent identity, not just per framework
• Audit log with agent identities — every tool call logged with agent identity, timestamp, and policy evaluation
• Signed skill verification — verify Skill Protocol v2 skills at load time
• Model-agnostic — works with Claude, GPT, Gemini, DeepSeek, Mistral, and local models
• Dashboard and reporting — usage per agent, policy violations, and OWASP coverage dashboards
• SOC 2 and ISO 27001 alignment — audit logs formatted for compliance reporting

Installation

# Docker
docker pull agentguard/runtime:latest
docker run -p 9400:9400 agentguard/runtime

# Or via npm
npm install -g @agentguard/runtime

# Python SDK
pip install agentguard-sdk

Quick Start

from agentguard import Runtime
from anthropic import Anthropic

runtime = Runtime(config_path="./policies.yaml")
client = runtime.wrap(Anthropic(api_key="..."))

# Normal usage; runtime intercepts every call
response = client.messages.create(
    model="claude-opus-4-7",
    messages=[{"role": "user", "content": "Review this code for security issues: ..."}],
    tools=[...],
)

Policy Configuration

# policies.yaml
default_agent:
  identity: "*"
  tools_allowed: [github-read, github-write, filesystem-read]
  tools_denied: [github-admin, admin-*]
  dlp:
    enabled: true
    pii_patterns: [email, ssn, credit_card]
  memory_protection:
    writer_verification: true
    poison_detection: true
  tool_output:
    schema_validation: true
    adversarial_detection: true

agent:security-reviewer:
  identity: "agent:security-reviewer"
  extends: default_agent
  tools_allowed: [github-read, github-annotate]
  tools_denied: [github-write, github-admin]

Advanced Features

• Policy-as-code — policies can be expressed in YAML or programmatic DSL, evaluated at runtime
• Runtime verification properties — encode invariants like "this agent never writes to user-facing tables" and enforce them
• Cross-agent policy coordination — policies can constrain interactions between agents (e.g., planner can't override coder's tool access)
• Skill signing — verify Skill Protocol v2 skills cryptographically before execution
• MCP server verification — verify MCP server identity before registering tools

MCP Configuration

{
  "mcpServers": {
    "agentguard": {
      "command": "agentguard-mcp",
      "args": ["--config", "./policies.yaml"],
      "env": {
        "AGENTGUARD_API_KEY": "***"
      }
    }
  }
}

Examples

Enforce least privilege for a coding agent:

from agentguard import Runtime

runtime = Runtime(config_path="./policies.yaml")

# Any tool call violating the policy is rejected with a structured error
try:
    result = runtime.invoke_tool(
        "github-write",
        agent_id="agent:coder",
        args={"path": "src/auth.py", "content": "..."},
    )
except PolicyViolation as e:
    print(e.category)  # "A07" — agent privilege escalation
    print(e.explanation)

Pros

• First runtime to address the full OWASP Agentic v2.1 catalog
• Framework-agnostic — wraps any agent framework
• Runtime verification provides real enforcement, not just detection
• Comprehensive audit logging for compliance
• Property-based safety is a genuinely novel approach

Cons

• Adds latency to every tool call (typically 5-15ms, configurable)
• Policy authoring requires security expertise
• Newer runtime; smaller community than comparable services-mesh tools

When to Use

• Building production agents in regulated industries
• Needing OWASP Agentic v2.1 compliance
• Wanting runtime enforcement, not just detection
• Multi-agent systems needing cross-agent policy enforcement

Resources

• Website: https://agentguard.dev
• GitHub: https://github.com/agentguard/runtime
• Docs: https://agentguard.dev/docs