Agentguard

AgentGuard

[](https://github.com/nikegunn/agentguard/releases) [](https://github.com/nikegunn/agentguard/actions/workflows/ci.yml) [](LICENSE) [](https://goreportcard.com/report/github.com/nikegunn/agentguard) [](https://docs.sigstore.dev/cosign/overview/) [](https://nikegunn.github.io/agentguard/)

> Zero-trust security sidecar for AI agents — Claude Code, Cursor, Codex, > Gemini CLI, Windsurf, or anything that speaks MCP.

AgentGuard sits transparently between your AI agent and the tools it calls. Every JSON-RPC frame goes through a five-stage inspection pipeline that catches prompt injection, tool poisoning, rug pulls, runaway loops, and credential exfiltration before they reach your model — or your customers' data.

curl -fsSL https://agentguard.space/install | sh
agentguard init        # detects + patches every installed agent
agentguard dashboard   # opens http://127.0.0.1:7878

That's it. The next tool call your agent makes is now inspected.

See it

The local web dashboard — live tool-call feed, per-server trust scores, call-detail waterfall, command palette, dark/light:

agentguard tail — live TUI feed of every call

agentguard doctor — Homebrew-style health check

> Want to regenerate or add the scan / install / agent-onboarding GIFs? > See [demo/README.md](demo/README.md) for the one-command render workflow.

Why

LLM agents trust their tools by default. A poisoned MCP server can rewrite its tool descriptions between sessions, embed prompt injections in responses, or quietly funnel your credentials to a webhook. Your IDE's approval prompt won't catch any of that — it just shows the human-readable intent. AgentGuard inspects the wire.

What you get

• Single Go binary. No daemon, no Docker, no kernel modules.
• Local-only. No account, no telemetry, no cloud. Your data stays on

your machine.

• **` instead of the

upstream server directly. The agent doesn't notice. The server doesn't notice. The inspection happens in the middle.

[Full architecture →](docs/src/architecture.md) [Threat model →](docs/src/threat-model.md)

Commands

| Command | What | |------------------------------|---------------------------------------------------| | agentguard init | Detect agents, patch their configs. | | agentguard dashboard | Local web UI at 127.0.0.1:7878. | | agentguard tail | Live TUI of tool calls. | | agentguard scan | Fire the attack corpus at an MCP server. | | agentguard doctor | Homebrew-style health check. | | agentguard replay | Re-run the pipeline against historic traffic. | | agentguard pack list/show/verify | Manage rule packs. | | agentguard uninstall | Restore every config byte-for-byte. |

Status

Feature-complete for v1 launch (M5 done). Polish + signing pipeline landed in M6. See [CHANGELOG.md](CHANGELOG.md) for the full milestone log.

Contributing

Issues and PRs welcome. We're particularly interested in:

• New rule packs for popular MCP servers
• More agent detectors (Aider, Cline, Continue, etc.)
• Additional prompt-injection corpora

See [CONTRIBUTING.md](CONTRIBUTING.md).

License

MIT. See [LICENSE](LICENSE).

Sponsors

AgentGuard is built and maintained for free. If your team depends on it, sponsor the project → (Bronze / Silver / Gold tiers).

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: NikeGunn
• Source: NikeGunn/agentguard
• License: MIT
• Homepage: https://agentguard.space

Install and usage instructions live in the source repository linked above.