Agent GuardKeep AI agents inside their boundaries.

Enforce workspace policies, request human approval, and audit supported filesystem operations without overstating the security boundary.

Get started

Watch the demo

View on GitHub

🛡️

Boundary enforcement

Canonical paths, symlink checks, deny-first rules, and default-deny handling outside the workspace.

✋

Human approval

Timeouts, operation-bound tokens, replay prevention, and resource revalidation before execution.

🔌

SDK and MCP wrappers

Actual prevention for operations routed through the Node.js filesystem or wrapped MCP tool APIs.

🧾

Auditable decisions

Structured JSONL records with redaction, rotation, session identifiers, and correlation IDs.

🚨

Security events

Typed events and opt-in terminal, webhook, desktop, and audit-only watcher integrations.

🔍

Honest capabilities

A clear distinction between SDK enforcement, agent hooks, OS sandboxes, and audit-only monitoring.

Install

bash

npm install @agent-utils/agent-guard

Try the repository's paced terminal demonstration with npm run demo, or use npm run demo:quick in CI.

Agent Guard supports Node.js 20 or newer and ships ESM, CommonJS, and TypeScript declarations.

Security boundary

Agent Guard blocks only operations routed through a supported enforcing integration. It does not intercept unrelated processes or replace an operating-system sandbox.