cf-agentguard

Antivirus for AI Agents. 131+ detection rules across static scanning, MCP runtime proxy, and pre-install vetting. Covers 8/10 OWASP Agentic Security Initiative categories. Protects against prompt injection, data exfiltration, MCP protocol attacks, memory poisoning, trust exploitation, and supply chain compromise.

Supported platforms: OpenClaw (Node.js skills), Open WebUI (Python functions/tools + SQLite DB extraction). More coming soon.

Install

npm install -g @foxifi.io/agentguard

The CLI is installed as agentguard:

agentguard --help

Without installing globally:

npx @foxifi.io/agentguard --help

Quick Start

cd /path/to/your/project
agentguard init

init auto-detects your AI agent platform (OpenClaw, Open WebUI, etc.), creates a .agentguard/ config directory, generates a .env with secure defaults, and seeds bundled threat definitions.

agentguard scan       # scan installed skills for security threats
agentguard fix        # auto-remediate fixable issues
agentguard protect    # start the continuous protection daemon

To target a specific platform:

agentguard scan --platform open-webui
agentguard scan --platform openclaw
agentguard scan --path /path/to/installation

Commands

| Command | Description | |---------|-------------| | agentguard init | Set up AgentGuard for your AI agent platform (auto-detects OpenClaw, Open WebUI) | | agentguard scan | Check all installed skills for security threats (--platform to override, --mcp-only for MCP only) | | agentguard fix | Fix security issues (quarantine, dependency updates, credential rotation) | | agentguard report | View or export the latest scan results (terminal / JSON / HTML) | | agentguard watch | Watch for new or changed skills in real time | | agentguard protect | Start ongoing protection with alerting (--daemon to background, --mcp to proxy MCP traffic) | | agentguard update | Update AgentGuard to the latest version via npm | | agentguard unlock | Unlock Pro tier features (opens browser) | | agentguard status | Check whether AgentGuard is running and healthy | | agentguard log | View recent security activity | | agentguard mcp-check <pkg> | Pre-install security check for an MCP server package | | agentguard mcp-relay | [internal] MCP stdio proxy with security inspection, invoked by protect --mcp | | agentguard mcp-audit | View the MCP message audit log (--stats for per-server summary) | | agentguard verify-audit-mcp | Verify the MCP audit log's hash chain hasn't been tampered with | | agentguard mcp-policy | Show the active MCP tool policy (allow/deny/confirm, rate limits) |

Run agentguard <command> --help for the full option list of each command.

What Gets Scanned

| Module | What It Checks | |--------|-----------------| | GatewayScan | Proxy config, bind address, auth token, CORS, TLS | | InstalledSkillsScan | Static analysis, injection patterns, dependencies, reputation | | CredentialScan | Leaked secrets in config files and environment | | EnvironmentScan | Platform security, Node.js version, permissions | | MCP Static (CG-MCP-001~004) | Unresolvable source, env secret exposure, tool description injection, excessive tools | | MCP Runtime (CG-MCP-RT-001~018) | Tool policy, injection, rate limit, credentials, response injection, memory poisoning, trust exploitation, server-initiated sampling, tools/list drift, SSRF, command injection, path traversal, protocol version drift, lockout, notification flood | | MCP Registry (CG-MCP-REG-001~003) | npm metadata evaluation, Smithery lookup, pre-install code scan with tarball integrity verification | | OWASP ASI06 (CG-MEM-001~004) | Persistent memory injection, context stuffing, RAG poisoning, history manipulation | | OWASP ASI09 (CG-TRUST-001~004) | Fake confirmations, approval bypass, role impersonation, social engineering |

Detection rules span static, runtime, and pre-install scanning, covering 8/10 OWASP Agentic Security Initiative categories.

MCP Security

AgentGuard protects Model Context Protocol servers at three points in their lifecycle:

1. Before you install a server — check it before it ever touches your machine:

agentguard mcp-check @modelcontextprotocol/server-filesystem

This evaluates npm registry metadata (age, download counts, maintainers), cross-checks the Smithery registry, and runs a static code scan against a npm pack --ignore-scripts tarball whose SHA-512 hash is verified against the registry's published dist.integrity — so postinstall RCE and MITM/hijacked-mirror tampering are caught before any script executes. It prints a SAFE / WARNING / DANGEROUS grade and recommendation.

2. While a server is running — proxy and inspect live MCP traffic:

agentguard protect --mcp

This rewrites your platform's MCP config so each configured server is launched through AgentGuard's stdio relay (mcp-relay) instead of directly, transparently inspecting every JSON-RPC message in both directions. The inspector enforces tool allow/deny/confirm policy, per-tool rate limiting with progressive-penalty server lockout, and blocks or alerts on prompt injection, credential leaks, SSRF/command-injection/path-traversal in tool arguments, memory poisoning, trust exploitation, and unexpected tools/list drift or protocol-version mismatches. Run agentguard protect --restore to revert the config back to launching servers directly.

Tune the policy in .agentguard/config.yml:

mcp:
  tool_policy:
    allow: ['*']
    deny: ['exec_shell']
    require_confirmation: ['delete_file']
  rate_limit:
    default: '60/min'
    overrides:
      search: '120/min'
  inspect_responses: true
  block_on_injection: true
  block_sampling: false

Check the effective policy at any time with agentguard mcp-policy.

3. After the fact — every inspected message is written to a tamper-evident, hash-chained audit log:

agentguard mcp-audit --stats     # per-server totals: events, blocked, alerts
agentguard mcp-audit -n 50       # last 50 raw events
agentguard verify-audit-mcp      # verify the hash chain hasn't been tampered with

Connecting to a Hub

For centralized management across a fleet of agents, point the client at a AgentGuard Hub:

# .env
HUB_URL=https://hub.example.com
HUB_API_KEY=your-api-key-here
HUB_HMAC_SECRET=your-hmac-secret-here

This enables centralized scan results, fleet-wide threat definition distribution, license management, and organization-level dashboards. The Hub is optional — the client works fully standalone.

Requirements

• Node.js >= 23.4.0 (uses built-in node:sqlite; no native modules to compile)

Links

• Repository
• Issues