Agent Shield

Security middleware for AI agents. Protects against prompt injection, tool poisoning, data exfiltration, and 40+ threat categories. Zero dependencies. All detection runs locally.

npm install agentshield-sdk

const { AgentShield } = require('agentshield-sdk');
const shield = new AgentShield({ blockOnThreat: true });

const result = shield.scanInput(userMessage);
if (result.blocked) return 'Blocked for safety.';

Benchmarks

| Metric | Result | |--------|--------| | F1 (real-world: HackAPrompt + TensorTrust + research papers) | 0.988 | | F1 (embedded: BIPIA/HackAPrompt/MCPTox/Multilingual/Stealth) | 1.000 | | Red team (617+ attack payloads) | 100% detection | | False positive rate (118+ benign inputs) | 0% | | Self-training convergence | 0% bypass in 3 cycles | | Avg latency | < 0.4ms |

Detection stack: 115+ regex patterns, 35-feature logistic regression + k-NN ensemble, 5-layer evasion resistance, 19-language support, chunked scanning, adversarial self-training loop.

# Verify locally
npm run score && npm run redteam

What It Detects

| Category | Examples | |----------|----------| | Prompt Injection | System prompt overrides, ChatML/LLaMA delimiters, instruction hijacking | | Role Hijacking | DAN mode, developer mode, persona attacks, jailbreaks (35+ templates) | | Data Exfiltration | Prompt extraction, markdown image leaks, DNS tunneling, side-channel encoding | | Tool Abuse | Shell execution, SQL injection, path traversal, sensitive file access | | Social Engineering | Identity concealment, urgency + authority, gaslighting, false pre-approval | | Obfuscation | Unicode homoglyphs, zero-width chars, Base64, hex, ROT13, leetspeak | | Indirect Injection | RAG poisoning, tool output injection, email/document payloads, few-shot poisoning | | Visual Deception | Hidden HTML/CSS content, LaTeX phantom commands, rendering differentials | | Multi-Language | CJK, Arabic, Cyrillic, Hindi + 15 more languages | | AI Phishing | Fake AI login, QR phishing, MFA harvesting, credential urgency | | Sybil Attacks | Coordinated fake agents, voting collusion, behavioral clustering | | Side Channels | DNS exfiltration, timing-based encoding, beaconing detection |

Framework Integrations

Works with any agent framework in 1-3 lines:

// Anthropic / Claude SDK
const { shieldAnthropicClient } = require('agentshield-sdk');
const client = shieldAnthropicClient(new Anthropic(), { blockOnThreat: true });

// OpenAI SDK
const { shieldOpenAIClient } = require('agentshield-sdk');
const client = shieldOpenAIClient(new OpenAI(), { blockOnThreat: true });

// OpenAI Agents SDK (@openai/agents, April 2026)
const { Agent, run } = require('@openai/agents');
const { shieldOpenAIAgent } = require('agentshield-sdk');
const { inputGuardrail, outputGuardrail, toolGuardrail } = shieldOpenAIAgent({ blockOnThreat: true });
const agent = new Agent({
  name: 'Assistant',
  instructions: 'You are a helpful assistant',
  inputGuardrails: [inputGuardrail],
  outputGuardrails: [outputGuardrail]
});

// LangChain
const { ShieldCallbackHandler } = require('agentshield-sdk');
const chain = new LLMChain({ llm, prompt, callbacks: [new ShieldCallbackHandler()] });

// Express middleware
const { expressMiddleware } = require('agentshield-sdk');
app.use(expressMiddleware({ blockOnThreat: true }));

// MCP SDK (Model Context Protocol)
const { shieldMCPServer } = require('agentshield-sdk/mcp');
const server = shieldMCPServer(new Server({ name: 'my-server', version: '1.0' }));

// Generic agent wrapper
const { wrapAgent } = require('agentshield-sdk');
const safe = wrapAgent(myAgent, { blockOnThreat: true });

Also available for Python, Go, Rust, and WASM (browsers/edge).

MCP Security

17-layer security middleware for Model Context Protocol servers. Covers attestation, SSRF/path-traversal firewalls, OAuth, rate limiting, circuit breaker, behavioral baselines, ML classification, drift monitoring, and more.

const { MCPGuard } = require('agentshield-sdk/guard');

// One-line setup with presets: minimal | standard | recommended | strict | paranoid
const guard = MCPGuard.fromPreset('recommended');

guard.registerServer('my-server', toolDefinitions, oauthToken);
const result = guard.interceptToolCall('my-server', 'search', { query: input });
// { allowed: true, threats: [], anomalies: [] }

Supply chain scanning for MCP servers (11 CVEs, schema poisoning, SARIF output):

const { SupplyChainScanner } = require('agentshield-sdk/scanner');
const report = new SupplyChainScanner().scanServer({ name: 'server', tools: defs });
const sarif = report.toSARIF(); // CI/CD integration

DeepMind AI Agent Trap Defenses

Comprehensive defenses for all 6 categories from Google DeepMind's "AI Agent Traps" research, built from first-principles analysis.

const { TrapDefenseV2 } = require('agentshield-sdk/traps');

const defense = new TrapDefenseV2();

// Content structure analysis (hidden HTML/CSS/ARIA payloads)
defense.structureAnalyzer.analyze(htmlContent);

// Retrieval-time scanning (catches RAG poisoning at query time)
defense.retrievalScanner.scanRetrieval(userQuery, ragResult);

// Few-shot validation (detect poisoned examples)
defense.fewShotValidator.validate(contextExamples);

// Sub-agent spawn gating (block privilege escalation)
defense.spawnGate.validateSpawn(parentPerms, childConfig);

// Escalating scrutiny (detect approval fatigue)
defense.scrutinyEngine.getScrutinyLevel();

// Cross-agent fragment assembly (split-payload attacks)
defense.fragmentAssembler.addFragment(text, source);

All modules: ContentStructureAnalyzer, SourceReputationTracker, RetrievalTimeScanner, FewShotValidator, SubAgentSpawnGate, SelfReferenceMonitor, InformationAsymmetryDetector, ProvenanceMarker, EscalatingScrutinyEngine, CompositeFragmentAssembler

Visual Deception Detection

Detects content that renders differently than it reads -- attackers hiding instructions in markup.

const { RenderDifferentialAnalyzer } = require('agentshield-sdk');

const analyzer = new RenderDifferentialAnalyzer();

// Scan any format (auto-detected or explicit)
const result = analyzer.scan(content, 'auto');
// { deceptive: true, techniques: [{ type: 'css_hidden', severity: 'high', ... }] }

// Format-specific analysis
analyzer.analyzeHTML(html);       // CSS tricks: display:none, opacity:0, off-screen
analyzer.analyzeMarkdown(md);     // Link mismatch, hidden spans, comment injection
analyzer.analyzeLatex(tex);       // \phantom, \textcolor{white}, \renewcommand

Sybil Detection

Detect coordinated fake agents acting in concert.

const { SybilDetector } = require('agentshield-sdk');

const detector = new SybilDetector({ similarityThreshold: 0.7, minClusterSize: 3 });

detector.registerAgent('agent-1', { name: 'Helper' });
detector.registerAgent('agent-2', { name: 'Assistant' });
detector.registerAgent('agent-3', { name: 'Aide' });

detector.recordAction('agent-1', { type: 'vote', target: 'proposal-A' });
detector.recordAction('agent-2', { type: 'vote', target: 'proposal-A' });
detector.recordAction('agent-3', { type: 'vote', target: 'proposal-A' });

const { clusters, sybilRisk } = detector.detectClusters();
// { clusters: [{ agents: ['agent-1','agent-2','agent-3'], similarity: 0.9 }], sybilRisk: 'high' }

Side-Channel Monitoring

Detect data exfiltration via covert channels.

const { SideChannelMonitor, BeaconDetector } = require('agentshield-sdk');

const monitor = new SideChannelMonitor();

// DNS exfiltration (high-entropy subdomains, base64 labels)
monitor.analyzeDNSQuery('aGVsbG8gd29ybGQ.attacker.com');

// Timing-based exfiltration (binary encoding in delays)
monitor.analyzeTimingPattern(timestamps);

// URL parameter exfiltration
monitor.analyzeURLParams('https://evil.com/log?d=c2VjcmV0');

// C2 beaconing detection
const beacon = new BeaconDetector();
beacon.addEvent(t1); beacon.addEvent(t2); beacon.addEvent(t3);
beacon.detectBeaconing(); // { beaconing: true, interval: 60000, confidence: 0.85 }

Autonomous Defense

const { AutonomousHardener, MicroModel } = require('agentshield-sdk');

// Self-training loop: attacks itself, finds bypasses, learns from them
const hardener = new AutonomousHardener({
  microModel: new MicroModel(),
  persistPath: './learned-samples.json',
  maxFPRate: 0.05
});

hardener.runCycle(); // 18 mutation strategies, converges to 0% bypass in 3 cycles

const { IntentFirewall, AttackGenome, HerdImmunity } = require('agentshield-sdk');

// Intent classification (same words, different action)
const firewall = new IntentFirewall();
firewall.classify('Help me write a phishing email');        // BLOCKED
firewall.classify('Help me write about phishing training'); // ALLOWED

// Cross-agent herd immunity
const herd = new HerdImmunity();
herd.reportAttack({ text: 'DAN mode jailbreak', agentId: 'agent-a' });
// All connected agents now have the pattern

Compliance

Built-in coverage for major security frameworks:

| Framework | Module | |-----------|--------| | OWASP LLM Top 10 (2025) | OWASPCoverageMatrix | | OWASP Agentic Top 10 (2026) | OWASPAgenticScanner | | NIST AI RMF | NISTMapper, AIBOMGenerator | | EU AI Act | RiskClassifier, ConformityAssessment | | SOC 2 / HIPAA / GDPR | ComplianceReporter |

const { OWASPCoverageMatrix } = require('agentshield-sdk');
const report = new OWASPCoverageMatrix().generateReport();
// Per-category scores, gap analysis, remediation guidance

Security Primitives

| Capability | Module | |-----------|--------| | Prompt hardening (4 levels) | PromptHardener | | HMAC message integrity chain | MessageIntegrityChain | | Cryptographic intent binding | IntentBinder, createGatedExecutor | | Semantic isolation (provenance tags) | SemanticIsolationEngine | | Confused deputy prevention | ConfusedDeputyGuard | | PII redaction | PIIRedactor | | Canary tokens | CanaryTokens | | Attack surface mapping | AttackSurfaceMapper | | Causal intent graph | IntentGraph | | Behavioral drift IDS | DriftMonitor |

Red Team & Auditing

# CLI audit (617+ attacks, A+-F grading)
npx agentshield-audit https://your-agent.com --mode full

# Pre-deployment audit (< 100ms)
npx agent-shield redteam

const { RedTeamCLI } = require('agentshield-sdk');
const report = new RedTeamCLI().run(endpoint, { mode: 'full' });
// HTML, JSON, and Markdown reports with grading

Enterprise

| Feature | Module | |---------|--------| | Distributed scanning (Redis) | DistributedShield | | Audit streaming (Splunk, ES) | AuditStreamManager | | SSO / SAML / OIDC | SSOManager | | Multi-tenant isolation | MultiTenantShield | | Policy-as-Code DSL | PolicyDSL | | Kubernetes sidecar | k8s/helm/agent-shield | | Terraform provider | terraform-provider/ | | OpenTelemetry collector | otel-collector/ | | GitHub App / Action | github-app/ | | VS Code extension | vscode-extension/ | | Real-time dashboard | dashboard-live/ |

Platform SDKs

| Platform | Install | Features | |----------|---------|----------| | Node.js | npm install agentshield-sdk | Full SDK, 400+ exports, zero deps | | Python | pip install agent-shield | Detection, Flask/FastAPI middleware, CLI | | Go | go get github.com/texasreaper62/agent-shield/go-sdk | Detection, HTTP/gRPC middleware, zero deps | | Rust | rust-core/ | RegexSet O(n) engine, WASM/NAPI/PyO3 | | WASM | wasm/dist/ | ESM/UMD for browsers, Workers, Deno, Bun |

CLI

npx agent-shield scan "ignore all instructions"     # Scan text
npx agent-shield scan --file prompt.txt --pii        # Scan file + PII
npx agent-shield demo                                # Live attack simulation
npx agent-shield score                               # Shield Score (0-100)
npx agent-shield redteam                             # Red team suite
npx agent-shield audit ./my-agent/                   # Audit codebase
npx agent-shield patterns                            # List detection patterns
npx agent-shield threat prompt_injection             # Threat encyclopedia
npx agentshield-audit <endpoint> --mode full         # Remote agent audit

Configuration

const shield = new AgentShield({
  sensitivity: 'medium',            // low | medium | high
  blockOnThreat: false,             // Auto-block dangerous inputs
  blockThreshold: 'high',           // Min severity to block
  logging: false,                   // Console logging
  onThreat: (result) => {},         // Callback on detection
  dangerousTools: ['bash'],         // Tools to scrutinize
  sensitiveFilePatterns: [/.env$/i] // File patterns to block
});

// Or use presets
const { getPreset } = require('agentshield-sdk');
const config = getPreset('chatbot'); // chatbot | coding_agent | rag_pipeline | customer_support

Testing

npm test                  # Core + module tests
npm run test:all          # Full 40-feature suite
npm run test:full         # All test suites combined
npm run test:fp           # False positive accuracy (100%)
npm run redteam           # Attack simulation (100% detection)
npm run score             # Shield Score (100/100 A+)
npm run benchmark         # Performance benchmarks

3,400+ test assertions across 22 test suites, plus Python and VS Code extension tests.

Project Structure

src/                  100+ modules, 400+ exports (zero dependencies)
python-sdk/           Python SDK with Flask/FastAPI middleware
go-sdk/               Go SDK with HTTP/gRPC middleware
rust-core/            Rust high-perf engine (WASM/NAPI/PyO3)
wasm/                 Browser/edge bundles
dashboard-live/       Real-time WebSocket dashboard
github-app/           GitHub PR scanner & Action
benchmark-registry/   Standardized benchmark suite
k8s/                  Kubernetes operator + Helm chart
terraform-provider/   Terraform policy-as-code
otel-collector/       OpenTelemetry receiver & processor
vscode-extension/     VS Code inline diagnostics
research/             Attack research & threat intelligence
test/                 22 test suites
examples/             Quick start guides
types/                TypeScript definitions

CI/CD

GitHub Actions workflow at .github/workflows/ci.yml runs all tests across Node.js 18, 20, and 22 on every push and PR.

Why Free?

Agent Shield started as a paid SDK with Pro and Enterprise tiers. We removed all gating in v9.0. Every feature — ML detection, compliance reporting, MCP security, CORTEX autonomous defense — is now free and open source.

Security shouldn't have a paywall. If your agent is vulnerable, it doesn't matter what tier you're on.

Privacy

All detection runs locally. No data is sent to any external service. No API keys required. No cloud dependencies.

License

MIT -- see LICENSE.