Put a guard between your always-on agent and the internet.
A local proxy that holds your API keys, blocks prompt injection and secret leaks, records every call in a tamper-evident chain, and gives you one switch that stops everything. No dependencies. Works with any agent that can change a base URL.
How it works
agent --(client token)--> agent-guard --(real key injected)--> api.provider.com
| ^
| '-- response scanned for prompt injection
|-- request scanned for secrets
|-- rate limit, host allow list, kill switch
'-- hash-chained audit logWhat you get
Credential vault
Keys sit encrypted (AES-256-GCM, scrypt) and are injected on the way out. The agent holds only a rotatable token.
Injection scanner
Responses and streams are checked for override phrases, fake system tags, hidden Unicode and exfiltration requests.
Secret-leak blocker
Outbound bodies are scanned for key shapes and for every value in your vault. A match is refused.
Kill switch
One file stops every request, even if the process is wedged. Also available over the admin API.
Tamper-evident audit
Each log line carries the hash of the one before it. audit verify proves nothing was edited or removed.
Allow-listed egress
CONNECT tunnels reach only hosts you name, only with a token, and every attempt is logged.
Quick start
npm install -g @nirholas/agent-guard
export AGENT_GUARD_PASSPHRASE='a long passphrase'
agent-guard init
agent-guard vault set anthropic_key
agent-guard start
export ANTHROPIC_BASE_URL=http://127.0.0.1:8787/u/anthropic
export ANTHROPIC_API_KEY=<client token from init>Full steps, the config reference and container setups are in the README.
Honest about limits
Pattern scanning catches common attacks, not every attack. An agent that can open its own sockets can skip a proxy unless the network forces it through. Read the threat model before you rely on it.