AgentFox

Open-source guardrails and a tool-call firewall for AI agents.

AgentFox checks what your agent may read, may claim and may do, and refuses the rest. It contains prompt injection at the tool call, so it holds after the model has already been convinced. Works with OpenAI, Anthropic, LiteLLM, LangChain, LangGraph, MCP servers, Claude Code and Codex.

▶ Try it live, no account  ·  🚀 Self-host it  ·  📊 Every benchmark  ·  ⚖ How we compare

Docs · Getting started · Architecture · Contributing · What is built · Discussions

What it does

AgentFox sits on your agent's model and tool calls, in-process or as an HTTP gateway, and decides whether each one may happen. Every tool carries a declared impact tier, every agent holds explicit capability grants with argument limits, and every argument carries the provenance of where its value came from. A transfer whose recipient came out of a retrieved document is refused because of where the value came from, not because a detector recognised the payload. Every decision lands in a tamper-evident audit chain that an auditor can verify without trusting us.

Quickstart

Python 3.11 or newer.

With the dashboard

1. Sign up at useagentfox.com. The Agents page opens on Connect your first agent. Press Create a key: a workspace API key (nom_api_…), shown once.

2. In your repository, run the command the card shows, with your key and server filled in:

   pip install agentfox
   agentfox init --key nom_api_… --server https://…
   

   init reads your code without running it and reports the agents and tools it found. It then asks Add one line to main.py so your app's calls show up in AgentFox? Yes adds agentfox.auto("<agent>") to the file that runs the agent and saves the key in .agentfox/agentfox.env (owner-only, git-ignored). Leave it running: it runs the attack tests on your machine.

3. Press Add N agents to AgentFox. Each agent is allowed the tools its own code hands it: read tools with any arguments, tools that change something or send data out only with values from what the user asked.

4. The first attack test runs by itself. Add and test again adds the basic guardrails (prompt attacks in what users send, instructions hidden in tool results and documents, personal data and secrets in replies) and shows what got through before and after. On a new agent they go live blocking; on one with real traffic they watch until you switch them on.

5. Run your app. Its calls show up on the agent's Activity tab.

From the command line only

pip install agentfox
agentfox scan        # names every agent it found, ends with: agentfox up
agentfox up          # registers them, declares their tools, adds agentfox.auto()
python main.py       # run your app as usual
agentfox findings    # what it saw, and what it would have stopped

up uses the names the code gives your agents, the same names scan printed, and adds agentfox.auto() to Python apps, LangGraph, LangChain, CrewAI and AutoGen included. It starts in watch mode. Everything stays on your machine.

One key everywhere

export AGENTFOX_URL=https://…
export AGENTFOX_API_KEY=nom_api_…

With these set (or .agentfox/agentfox.env, or agentfox.auto(server=…, key=…)), every check agentfox.auto() makes goes to your account's gateway and the calls appear on the dashboard. Without a key it checks and records locally. Every OpenAI, Anthropic, LiteLLM and LangChain call in the process is checked, and every tool call in a response is checked before your code can run it; a refused one raises agentfox.Blocked.

Other ways in

• Check your machine (about 2 seconds): agentfox scan machine reads the MCP configs and skills that Claude Code, Cursor, Claude Desktop, VS Code, Windsurf, Gemini CLI and Codex load. Nothing is started, written or sent. Without installing: uvx agentfox scan machine.

• Your coding agent: in a project where you use Claude Code or Codex, agentfox up --with coding-agents writes the hooks, grants the agent its built-in tools and starts in watch mode, except shapes such as rm -rf ~/, which are refused from the start. Install AgentFox with uv tool install agentfox (or pipx) so the hooks find it from any directory.

• Behind a LiteLLM proxy: one block in the proxy's config.yaml checks every agent behind it (guide).

• Look around first: agentfox init && agentfox demo. init creates a SQLite database and loads 43 controls and the policy packs in about a second; demo runs a thirteen-step walkthrough in about five. Both are offline: no API key, no downloaded weights, no network egress.

• Scan this directory without installing: curl -fsSL https://raw.githubusercontent.com/architsharm/agentfox/main/scripts/quickscan.sh | bash

• On every pull request: the GitHub Action annotates lethal trifectas, ungoverned model calls and poisoned skills, and fails the check on the kinds you list in fail-on:

  - uses: actions/checkout@v4
  - uses: architsharm/agentfox@main
    with:
      fail-on: trifecta,skills
  

Contain a tool call

Any language can ask the gateway about one call before running it:

agentfox serve                              # gateway + control-plane API on 127.0.0.1:8080
agentfox admin users create you@example.com --token   # first operator + API token, shown once

curl -s -X POST http://localhost:8080/v1/guard/tool_call \
  -H "Authorization: Bearer $AGENTFOX_TOKEN" -H "Content-Type: application/json" \
  -d '{"agent":"payments-ops","tool":"payments.transfer",
       "arguments":{"amount":250,"currency":"USD","to":"acct_991"},
       "provenance":{"to":"tool_result","amount":"user"},
       "intent":"refund a duplicate charge"}' | jq '{verdict, approval_id}'

{ "verdict": "escalate", "approval_id": "apr_01m376q43zby33tbsp" }

The recipient came from a tool result, so the transfer waits for a human. Flip "to" to "user" and the same call returns allow. Once a person approves it (agentfox permit approvals approve apr_…), the same call with "approval_id" added runs, once. Pointed at /v1 as an OpenAI or Anthropic base URL, the gateway proxies model calls too, and a held one returns HTTP 428 with its approval_id. LangGraph, MCP, Claude Code hooks, the SDK and the full command set are in the website guides and the product tour.

Tracking without anyone running a command

A scan is a snapshot. Connect a GitHub repository, a hosted API's OpenAPI document or an MCP server once and AgentFox keeps re-checking it: every few hours, and on every push once the GitHub webhook is registered. What changed since the last run becomes a finding, and the finding closes itself when the condition clears. Setup and every finding type: Monitor connected sources.

What we measured

We do not claim adversarial robustness, and we do not believe anyone can. The Attacker Moves Second (Nasr, Carlini, Schulhoff et al., 2025) reports over 90% attack success against twelve published defences once the attacker adapts. So the number we lead with does not depend on catching anything: both rows below were measured with every detector switched off.

The cost is benign utility: when provenance is inferred, a legitimate action that copies a value out of a tool output looks the same as an attack, and it is escalated.

Optionally, detection gets better. The judgment tiers are off by default; with them on, agentfox catches 160/165 of the injection payloads that defeated our own pattern detectors, at 94.7% precision against the NotInject over-defense set. What each tier is worth, and what it costs.

Where we are still improving

Detection is the layer we trust least, so we publish its numbers.

• The default injection stack (heuristic plus the PIGuard classifier) has a held-out recall of 68.3%, at 100% precision (REPORT.md). It needs agentfox[classifiers] and the model weights, which the Docker image ships; without them the heuristic runs alone, and its held-out injection recall is 16.7%; the startup warning and agentfox doctor say so.
• On NotInject, 339 benign prompts built to trip keyword guardrails, the classifier flags 11.5% (39/339) at the level an enforcing policy acts on (PIGuard alone), and 41% (140/339) counting the advisory backstop hits that observe mode records.
• An adaptive attacker that reads our verdict and retries gets 74% of the attacks we catch through within 50 attempts, measured against the heuristic-only stack that was the default until October 2026.
• The deterministic answerability classifier abstains on 57/676 contested questions; with a judgment tier that becomes 572/676, at the cost of over-refusal rising from 0.75% to 6.8%.
• Against a real, independently installed llm-guard on indirect injection via tool output, it is more precise than us: 81.8% against our 66.7% on the same 20 cases, though of the 10 attacks among them we catch all 10 and it catches 9. That run predates October 2026, while the backstop model's hits still counted toward a block (agent_security).
• On AgentDojo, per-argument taint misses 61 of 702 attacker write calls; session-level taint misses none of them and escalates three in four benign tasks.
• The default stack reaches 86.4% and 98.4% recall on two independent datasets (SPML and yanismiraoui), but on long prompts (around 2,000 characters and up) the classifier mostly times out within its 250 ms budget and the request falls back to the heuristic.

Treat every detection number as a speed bump that raises attacker cost, never as a defence.

Not built yet

• It is only as good as your declarations. A destructive tool declared read is treated as read. agentfox doctor grades this; agentfox scan finds undeclared tools.
• You declare the estate yourself. No Okta, no DataHub; principals and grants live in AgentFox.
• Compliance mappings are DRAFT, not reviewed by counsel, and labelled so in every export.
• Version 0.3. No live IdP or SSO, single-org multi-tenancy enforced at the session, text only.

Live per-capability status, computed by probe: docs/status.md.

Documentation

Questions and ideas go to Discussions; bugs to Issues. New contributors: start with a good first issue.

Licence

The open core is Apache-2.0: the SDKs, the gateway and CLI, enforcement and containment, every detector and validator, custom rules, policy packs, the benchmarks and the dashboard. It runs on its own, with no licence key and no limit on agents.

AgentFox Enterprise (ee/) adds what an organisation needs to govern many agents and prove it: compliance status against EU AI Act, ISO 42001, SOC 2 and NIST AI RMF, auditor evidence packages, fleet monitoring with alerts, and checks against your own access control. It is source-available under the Business Source License 1.1: free in production for one workspace with up to four agents, and each release becomes Apache-2.0 three years after it ships. It is included on AgentFox Cloud.