Security & guardrails
guardrails and prompt-injection defense
microsoft/agent-governance-toolkit microsoft/agent-governance-toolkit leads the space with deterministic, application-level enforcement that makes denied agent actions fail-closed and provides tamper-evident audit trails. Before choosing, decide whether you need that strong runtime enforcement for high-risk production use or a lighter tool focused on red‑teaming, CLI-level guards, forensics, or developer UX — many projects exist to fill those narrower needs.
Which one matches your setup?
Answer any of the questions — the shortlist updates as you go. Recommendations come from the capability passports below, nothing else.
Comparison matrix
Axes are extracted from each project's docs by our review pipeline; the maturity score is computed from stars, growth and commit activity — not an opinion. Click a column to sort.
| Runs in | Models | Context | Cost to run | |||||
|---|---|---|---|---|---|---|---|---|
⭐ 6.6k +662/7d | CLICoding-agent pluginIDE | BYOK | Diff + related files | Hard gates + report | ●●●●● | Self-hostable | ●●●●● | Free to use; runs locally or via your agent/API |
⭐ 2.8k +164/7d | CLICoding-agent plugin | OpenAIAnthropicFixed provider | Diff + related files | Armed / observing gating | ●●●●● | Self-hostable | ●●●●● | Free, local install; uses the host agent's model access (may require provider subscriptions). |
⭐ 6.5k +29/7d | PR botGitHub ActionCICLIIDECoding-agent pluginWeb app | BYOK | Action-level only | Approval gating | ●●●●● | Fully local runnable | ●●●●● | Free, open-source |
⭐ 1.7k +85/7d | CLICoding-agent pluginWeb app | Fixed provider | Command + related files | Presets + audit | ●●●●● | Local-only | ●●●●● | Free, local install (requires Node.js) |
⭐ 2.0k +2/7d | GitHub ActionCICLIWeb app | BYOKOpenAI | Prompt-only | Thresholds/config | ●●●●● | Self-hostable | ●●●●● | Your LLM API key, usage billed by the provider |
⭐ 1.1k +25/7d | CLIIDECoding-agent plugin | Fixed provider | Related files | Severity gating | ●●●●● | Runs locally | ●●●●● | Free, open-source local binary |
⭐ 509 +19/7d | CLIIDECoding-agent plugin | OpenAIAnthropicGeminiFixed provider | Whole-repo analysis | Rule-based guidance | ●●●●● | Fully local | ●●●●● | Free, local |
⭐ 319 | CLIWeb appCoding-agent pluginIDE | AnthropicFixed provider | Diff + related files | Approval workflow | ●●●●● | Self-hostable | ●●●●● | Free cloud account available; self-host option |
⭐ 260 +7/7d | CLI | Anthropic | Full-history scans | Multi-stage filtering | ●●●●● | Fully local | ●●●●● | Free, local app |
⭐ 136 | PR botGitHub ActionCICLICoding-agent plugin | OpenAIAnthropicFixed provider | Diff + related files | Preset & filters | ●●●●● | Self-hostable | ●●●●● | Runs as a GitHub Action (consumes runner minutes) or as a local CLI |
⭐ 106 | Coding-agent pluginCLIWeb appCI | Anthropic | Related files | Enforcement hooks | ●●●●● | Cloud + local hooks | ●●●●● | Anthropic Claude Code account required |
Capability profiles
Six axes, 0–5 each. The shape tells you the strategy: a wide hexagon is a generalist, a spike is a specialist. Showing the 8 most established — the rest are in the full catalog.
A rule-based filter with a mandatory PASS/FAIL Delivery Gate and liveliness toolkit focused on removing generic AI-generated UI and copy without prescribing visual style.
Implements executable, evidence-backed Guards and Skills that intercept unrequested hashes, dependency/subagent launches and scope creep across multiple agent hosts, turning policy statements into machine-enforceable checks.
Deterministic, application-level enforcement that intercepts every tool call and makes denied actions structurally impossible (fail-closed governance plus tamper-evident audit), rather than relying on prompt-level controls.
Parses command semantics (including shell wrappers and interpreter one-liners) to block destructive commands and secret access before they execute across many coding agent CLIs.
Agentic Security focuses on agent/workflow-focused, multimodal (text, image, audio) and multi-step attack/fuzzing capabilities (including RL-based and dataset mutation approaches) to evaluate LLM vulnerabilities beyond single-shot prompt tests.
Performs endpoint-local detection and forensic reconstruction from on-disk session artifacts, letting operators evaluate agent activity with the same rule engine used for live enforcement.
A minimal paste-in natural-language contract plus a curated case catalogue that specifically targets agents' 'over-defense' behaviours (HERO) without installing software.
Centralizes one source engineering playbook and renders agent-specific instruction files with governance, ownership and adoption tracking.
All repositories (11)
Rules for an AI coding agent to filter out generic AI-generated UI designs, text, and code.
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability e…
Stop That Shit（别再造史了）｜面向 Codex/GPT 场景的多平台 Hook + Skill Guard：拦截 AI coding agent 无需求的哈希、校验和与任务范围膨胀。 A multi-pla…
Agentic LLM Vulnerability Scanner / AI red teaming kit 🧪
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common at…
Visibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and fo…
HERO = Hashing · Edge cases · Rubrics · Overbuild — the four shapes coding agents over-defend in. A paste-in c…
Packmind seamlessly captures your engineering playbook and turns it into AI context, guardrails, and governanc…
native macOS app that gives you a real-time dashboard for your Claude Code and Cowork sessions, with analytics…
Quality gate for AI/Codex-generated pull requests: blocks TODO leftovers, leaked secrets, sloppy commits and r…
Make Opus 4.8 (or any Claude model) work like Claude Fable 5 — a Claude Code skill + guard hooks (plan gate, m…