AgentGuard is a self-hosted AI agent security gateway. It deterministically enforces spending caps, detects adversarial prompt injection, restricts high-privilege tools, and protects commerce checkouts like Razorpay and PayPal before payment operations execute.
Every capability is backed by real, deterministic implementation in Fastify, PostgreSQL, and TypeScript.
Apply deterministic limits to every agent action. Single-tx spending caps ($50 max), rolling daily budget caps ($200), currency allowlists (INR, USD, EUR, GBP), and recipient denylists.
Inspect untrusted text for adversarial prompt injection, jailbreaks, delimiter hijacking, and system prompt leaks before agents call tools or downstream APIs.
High-value transactions trigger an authoritative HOLD state. Actions are locked with an immutable cryptographic digest until an operator issues a single-use token.
Restrict agent execution to explicit tool namespaces. Any request invoking unapproved tools (shell_executor, raw SQL) is blocked at the gateway before reaching infrastructure.
Pre-flight policy evaluation for Razorpay and PayPal checkouts. Enforce amount, currency, and customer parameters before calling payment APIs. Verify HMAC signatures.
Every decision, scan, and order creation is logged to PostgreSQL with immutable requestId, sha256 digests, and policy versioning for complete auditability.
These are not hardcoded frontend animations. Each scenario sends real evaluation requests to AgentGuard’s Fastify backend, executes policy rules, and returns genuine decisions.
Adversarial user prompts attempt jailbreaks, delimiter hijacking, or secret prompt leaking to hijack agent tool execution.
AgentGuard scans input heuristics and token boundaries before execution. Injection payloads are immediately flagged and BLOCKED.
Autonomous agents can hallucinate excessive prices or trigger repeated loops, depleting merchant or customer bank balances.
Policy engine checks amount against strict per-transaction and 24h limits. Exceeding operations ($50 max) are strictly BLOCKED.
Compromised agents attempt to call high-privilege tools like command shells (shell_executor) or raw database query endpoints.
The gateway checks requested tools against an authorized whitelist. Unapproved tools are instantly BLOCKED with DISALLOWED_TOOL.
Agent-initiated commerce checkouts can attempt unverified currencies, rogue amounts, or bypass merchant business logic.
Merchant backend requests pre-flight evaluation. AgentGuard verifies limits and currencies. Razorpay orders are created ONLY on ALLOW.
High-value transactions execute without human oversight, creating serious financial liability and compliance risk.
Operations exceeding the review threshold ($25.00) return HOLD, creating an immutable approval record with cryptographic digest.
AgentGuard evaluates transactions before orders are created on Razorpay. Held or blocked actions never touch payment rails, and all completed payments are cryptographically verified using HMAC-SHA256 signatures.
AI agent or customer initiates an order. The merchant backend validates currency, customer identity, and amount.
Merchant calls AgentGuard policy engine. If the gateway is down or times out, the client authoritatively fails closed and blocks the transaction.
Only ALLOW triggers Razorpay order creation. HOLD triggers human reviewer review, and BLOCK immediately rejects the operation.
Orders are only marked as PAID after verifying cryptographic payment and webhook signatures using constant-time comparison.
Decisions are calculated through code rules and mathematical constraints, with complete isolation from untrusted client input.
Agent actions hit the AgentGuard proxy. Payloads are checked for prompt injection, disallowed tool names, and malicious delimiters.
The policy engine evaluates limits: max transaction amounts, cumulative daily spends, velocity windows, and human approval thresholds.
ALLOW issues a cryptographic authorization token. Execution is strictly tied to token validation, and every event is recorded in PostgreSQL.
AgentGuard is 100% open-source software under the MIT/Apache-2.0 license. Run it on your laptop, an internal VPC, or a $5 VPS with Docker Compose.