antguard 0.2.0

Guard, Detect, Protect.
Pure system-level profiler for AI data privacy. Like cProfile, but for data movement.

No AI, No API, No cloud, No regex, Works offline, Works air-gapped.

Install

pip install antguard

Optional extras:

pip install antguard[gpu]          # NVIDIA GPU monitoring
pip install antguard[policy]       # YAML policy files
pip install antguard[llmevalkit]   # combined report bridge
pip install antguard[all]          # everything

Quick Start

from antguard import Guard

# Context manager (recommended)
with Guard(watch=["./data/"]) as g:
    # your code runs here - completely unchanged
    agent.run("process confidential.pdf")

# The one answer that matters
print(g.did_data_leave())  # True or False

# Save reports
g.save("./logs/")  # creates .log + .txt + .json

What It Monitors

How It Works

antguard wraps your code from the outside. It never reads file contents. It tracks data flow by fingerprinting files and correlating byte movement.

API

from antguard import Guard, Policy

guard = Guard(
    watch=["./data/"],           # directories to monitor
    detect_outbound=True,        # network monitoring
    track_processes=True,        # process tree monitoring
    correlate=True,              # byte-flow correlation
    runtime=True,                # CPU/GPU/memory metrics
    gpu=True,                    # GPU monitoring
    policy=Policy({...}),        # security rules (optional)
    observe_endpoints=True,      # endpoint detection (optional)
    log_path="./logs/",          # log output directory
)

guard.start()
# ... your code ...
guard.stop()

# Core
guard.did_data_leave()       # bool
guard.file_events()          # list of file events
guard.net_events()           # list of network events
guard.proc_events()          # list of process events
guard.correlations()         # file-to-network matches
guard.matched_files()        # files found in outbound data
guard.runtime_metrics()      # CPU, GPU, memory summary
guard.risk_level()           # LOW / MEDIUM / HIGH / CRITICAL
guard.anomalies()            # runtime anomalies
guard.data_flow_map()        # full byte flow visualization
guard.save("./logs/")        # write reports
guard.summary()              # one-line summary

# Policy
guard.policy_violations()    # list of rule violations
guard.generate_baseline()    # auto-generate policy from observation

# Observer
guard.endpoint_calls()       # detected service endpoint calls
guard.file_to_endpoint()     # file read -> endpoint correlations
guard.observer_summary()     # services, call counts, bytes

Policy Engine

Define rules for allowed behavior. Three modes: audit, detect, enforce.

from antguard import Guard, Policy

policy = Policy({
    "file": {
        "allow_read": ["./data/*"],
        "deny_read": ["~/.ssh/*", "~/.aws/*"],
    },
    "network": {
        "allow": ["localhost"],
        "deny_all_other": True,
    },
    "process": {
        "deny_shell": True,
    },
    "mode": "detect",
})

with Guard(watch=["./data/"], policy=policy) as g:
    your_code()

for v in g.policy_violations():
    print(f"{v.category}: {v.rule} ({v.severity.value})")

Load from YAML: policy = Policy.from_yaml("antguard-policy.yaml")

Combined Report (Bridge)

Optional integration with llmevalkit for unified audit.

from antguard import Guard
from antguard.bridge import UnifiedAudit

with Guard(watch=["./data/"]) as g:
    response = your_code()

# with llmevalkit evaluation (optional)
audit = UnifiedAudit(guard=g, evaluation={"faithfulness": 0.94, ...})
audit.save("./reports/")

# without llmevalkit (standalone)
audit = UnifiedAudit(guard=g)
audit.save("./reports/")

Report Output

Text report (antguard_report_*.txt):

antguard Profiler Report
==================================================
Session    : a1b2c3d4
Platform   : Linux (6.5.0)
Duration   : 12.3 seconds

DATA LEFT SYSTEM: NO

-- FILE EVENTS (2) --
  [MODIFY  ] ./data/salary.pdf  240.0 KB  python(pid 4521)  LOW
  [CREATE  ] ./output/summary.txt  1.0 KB  python(pid 4521)  LOW

-- NETWORK EVENTS (0) --
  None

-- PROCESS EVENTS (3 total, 0 suspicious) --
  All processes normal

-- BYTE-FLOW CORRELATIONS (0) --
  No file-to-network correlations detected

-- RUNTIME METRICS (12 samples) --
  CPU avg/peak    : 35.2% / 72.1%
  Memory avg/peak : 8.2 GB / 8.5 GB
  Process RSS     : 156.0 MB avg, 189.0 MB peak
  GPU             : not detected

==================================================
OVERALL RISK: LOW
==================================================

Cross-Platform

Demos

No models, no API keys, no downloads needed. Every demo runs with plain Python.

Google Colab: Open quickstart notebook

Dependencies

Core: watchdog + psutil (that's it)

Optional: pynvml (GPU), pyyaml (YAML policies), llmevalkit (combined report)

Memory Footprint

< 25 MB RAM regardless of session length. Events stream to disk.

Part of the Ant Intelligence Ecosystem

• antguard - Guard. Detect. Protect. (system profiler)
• llmevalkit - Evaluate. Score. Improve. (AI evaluation)
• Together: full AI system audit

License

Apache 2.0

Author

Venkatkumar Rajan