@contail/agentguard
v1.1.21
Published
The vantage point security layer for AI agents — sees every LLM, MCP, and HTTP call across every agent runtime (Cursor, Claude Desktop, OpenClaw, Hermes, custom) and correlates attacks no per-agent guardrail can
Maintainers
Readme
AgentGuard
Reverse Proxy Firewall + LLM Gateway for AI Agents
AgentGuard is a security layer for local autonomous AI agents. It provides inbound request filtering, LLM tool call interception, and outbound PII sanitization — all in a single Go binary with zero dependencies.
Install
npm install -g @contail/agentguard
agentguard setupOr run directly:
npx @contail/agentguard setupFeatures
- Two-Stage Defense — 11-layer rule-based checks + optional remote trust evaluation
- LLM Gateway — Multi-provider (OpenAI + Anthropic) tool call interception with SSE streaming support
- MCP Security Gateway — Policy-based protection for IDE AI agents (Cursor, VS Code, Claude Desktop, Kiro)
- Config Diagnosis — Automated security audit with auto-fix engine (7 fields)
- PII Sanitization — Regex + entropy-based detection of emails, tokens, secrets in outbound requests
- Safe Auto-Setup — One command configures shell RC + OpenClaw, clean undo with
--undo
Usage
# Start (inbound proxy + LLM Gateway enabled by default)
agentguard
# Setup shell + OpenClaw integration
agentguard setup
# Security diagnosis + auto-fix
agentguard fix # Preview fixable issues
agentguard fix --apply # Apply all fixesAI Control Web Demo
npm install -g @contail/agentguard
agentguard demoThe npm package includes the Chrome extension files. agentguard demo starts the local policy API, opens the Chrome extensions page, opens the bundled extension folder, and copies the extension path to the clipboard. In Chrome, enable Developer mode, click Load unpacked, then press Cmd+V in the file picker if needed.
To run the Chrome extension policy API and desktop app/CLI proxy together:
AGENTGUARD_GATE_URL=http://127.0.0.1:8000 \
AGENTGUARD_GATE_API_KEY='<PROJECT_API_KEY>' \
agentguard demo all --mitmWhen AGENTGUARD_GATE_URL points at a local Trust Layer backend, the launcher checks the project API key before starting so audit webhook authentication errors fail fast.
Configuration
| Variable | Default | Description |
|----------|---------|-------------|
| AGENTGUARD_PORT | :10180 | Reverse proxy listen port |
| AGENTGUARD_LLM_ENABLED | true | Enable LLM Gateway |
| AGENTGUARD_LLM_PORT | :10081 | LLM Gateway listen port |
| AGENTGUARD_LLM_MODE | monitor | monitor or enforce |
| AGENTGUARD_LLM_PII | off | PII mode: off / monitor / sanitize / block |
| AGENTGUARD_GATE_ENABLED | true | Enable Stage 2 evaluation |
Supported Platforms
- macOS (Apple Silicon / Intel)
- Linux (x64)
- Windows (x64)
The npm package includes prebuilt binaries for supported platforms. The postinstall script installs the matching bundled binary automatically.
Links
License
MIT
