Security & guardrails
guardrails and prompt-injection defense
microsoft/agent-governance-toolkit Microsoft's agent-governance-toolkit is the de facto leader for teams that need deterministic, fail‑closed enforcement and tamper‑evident audits across developer workflows; however, many teams pick specialized tools for targeted needs like adversarial testing, shell-level blocking, local forensics, style gating or low-friction adoption. Choose the leader for end‑to‑end enforcement and pick a niche project when you need a specific capability the leader doesn't prioritize.
Which one matches your setup?
Answer any of the questions — the shortlist updates as you go. Recommendations come from the capability passports below, nothing else.
Comparison matrix
Axes are extracted from each project's docs by our review pipeline; the maturity score is computed from stars, growth and commit activity — not an opinion. Click a column to sort.
| Runs in | Models | Context | Cost to run | |||||
|---|---|---|---|---|---|---|---|---|
⭐ 6.2k +53/7d | PR botGitHub ActionCICLIIDECoding-agent pluginWeb app | BYOK | Action-level only | Approval gating | ●●●●● | Fully local runnable | ●●●●● | Free, open-source |
⭐ 2.0k +6/7d | GitHub ActionCICLIWeb app | BYOKOpenAI | Prompt-only | Thresholds/config | ●●●●● | Self-hostable | ●●●●● | Your LLM API key, usage billed by the provider |
⭐ 1.5k +13/7d | CLICoding-agent pluginWeb app | Fixed provider | Command + related files | Presets + audit | ●●●●● | Local-only | ●●●●● | Free, local install (requires Node.js) |
⭐ 1.5k +947/7d | CLICoding-agent plugin | OpenAIAnthropicFixed provider | Diff + related files | Armed / observing gating | ●●●●● | Self-hostable | ●●●●● | Free, local install; uses the host agent's model access (may require provider subscriptions). |
⭐ 984 +8/7d | CLIIDECoding-agent plugin | Fixed provider | Related files | Severity gating | ●●●●● | Runs locally | ●●●●● | Free, open-source local binary |
⭐ 841 +295/7d | CLICoding-agent pluginIDE | BYOK | Diff + related files | Hard gates + report | ●●●●● | Self-hostable | ●●●●● | Free to use; runs locally or via your agent/API |
⭐ 403 +60/7d | CLIIDECoding-agent plugin | OpenAIAnthropicGeminiFixed provider | Whole-repo analysis | Rule-based guidance | ●●●●● | Fully local | ●●●●● | Free, local |
⭐ 308 +1/7d | CLIWeb appCoding-agent pluginIDE | AnthropicFixed provider | Diff + related files | Approval workflow | ●●●●● | Self-hostable | ●●●●● | Free cloud account available; self-host option |
⭐ 234 +2/7d | CLI | Anthropic | Full-history scans | Multi-stage filtering | ●●●●● | Fully local | ●●●●● | Free, local app |
⭐ 105 | Coding-agent pluginCLIWeb appCI | Anthropic | Related files | Enforcement hooks | ●●●●● | Cloud + local hooks | ●●●●● | Anthropic Claude Code account required |
Capability profiles
Six axes, 0–5 each. The shape tells you the strategy: a wide hexagon is a generalist, a spike is a specialist. Showing the 8 most established — the rest are in the full catalog.
Deterministic, application-level enforcement that intercepts every tool call and makes denied actions structurally impossible (fail-closed governance plus tamper-evident audit), rather than relying on prompt-level controls.
Agentic Security focuses on agent/workflow-focused, multimodal (text, image, audio) and multi-step attack/fuzzing capabilities (including RL-based and dataset mutation approaches) to evaluate LLM vulnerabilities beyond single-shot prompt tests.
Parses command semantics (including shell wrappers and interpreter one-liners) to block destructive commands and secret access before they execute across many coding agent CLIs.
Implements executable, evidence-backed Guards and Skills that intercept unrequested hashes, dependency/subagent launches and scope creep across multiple agent hosts, turning policy statements into machine-enforceable checks.
Performs endpoint-local detection and forensic reconstruction from on-disk session artifacts, letting operators evaluate agent activity with the same rule engine used for live enforcement.
A rule-based filter with a mandatory PASS/FAIL Delivery Gate and liveliness toolkit focused on removing generic AI-generated UI and copy without prescribing visual style.
A minimal paste-in natural-language contract plus a curated case catalogue that specifically targets agents' 'over-defense' behaviours (HERO) without installing software.
Centralizes one source engineering playbook and renders agent-specific instruction files with governance, ownership and adoption tracking.
All repositories (10)
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability e…
Agentic LLM Vulnerability Scanner / AI red teaming kit 🧪
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common at…
Stop That Shit（别再造史了）｜面向 Codex/GPT 场景的多平台 Hook + Skill Guard：拦截 AI coding agent 无需求的哈希、校验和与任务范围膨胀。 A multi-pla…
Visibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and fo…
Rules for an AI coding agent to filter out generic AI-generated UI designs, text, and code.
HERO = Hashing · Edge cases · Rubrics · Overbuild — the four shapes coding agents over-defend in. A paste-in c…
Packmind seamlessly captures your engineering playbook and turns it into AI context, guardrails, and governanc…
native macOS app that gives you a real-time dashboard for your Claude Code and Cowork sessions, with analytics…
Make Opus 4.8 (or any Claude model) work like Claude Fable 5 — a Claude Code skill + guard hooks (plan gate, m…