megent 0.1.5

Open-source AI agent security middleware for policy-enforced tool calls, prompt injection defense, and PII masking

███╗   ███╗███████╗ ██████╗ ███████╗███╗   ██╗████████╗
████╗ ████║██╔════╝██╔════╝ ██╔════╝████╗  ██║╚══██╔══╝
██╔████╔██║█████╗  ██║  ███╗█████╗  ██╔██╗ ██║   ██║   
██║╚██╔╝██║██╔══╝  ██║   ██║██╔══╝  ██║╚██╗██║   ██║   
██║ ╚═╝ ██║███████╗╚██████╔╝███████╗██║ ╚████║   ██║   
╚═╝     ╚═╝╚══════╝ ╚═════╝ ╚══════╝╚═╝  ╚═══╝   ╚═╝   

A zero-trust safety layer for AI agents. Wrap tools fast. Ship with confidence.

Open-source AI agent security middleware for policy-enforced tool calls, prompt injection resistance, and PII masking.

Docs · Policies

---

Megent: Open-Source AI Agent Security Middleware

Megent helps secure AI agents by enforcing allow/deny tool policies, masking sensitive data, and logging every tool decision.

---

The Problem

AI agents are calling tools. Most of those calls look harmless. But sequences don't lie.

agent.read_file("/etc/passwd")          ← looks fine
agent.web_search("paste.bin upload")    ← looks fine  
agent.http_post("https://...")          ← looks fine

# combined? that's data exfiltration.

Traditional security tools inspect calls one by one. Megent enforces policy at execution time.

Built for teams that want speed without security debt.

---

How It Works

Megent sits between your agent and its tools, running every call through three primitives:

┌─────────────────────────────────────────────────────┐
│                    AGENT RUNTIME                    │
│                                                     │
│  tool_call() ──► [ INTERCEPT ] ──► [ CONTEXT ]      │
│                                          │          │
│                                     [ JUDGE ]       │
│                                          │          │
│                              allow / deny / modify  │
└─────────────────────────────────────────────────────┘

Primitive	Role
Intercept	Hooks into every tool invocation before execution
Context	Maintains a behavioral window — the sequence of recent calls
Judge	Evaluates the sequence against your policy rules

---

Install

pip install megent

---

Super Simple Setup (3 Steps)

No framework migration. No plugin boilerplate. Just one policy file and one decorator.

1. Create a megent.yaml file in your project root:

version: "1"
default_action: deny

tools:
  send_email:
    allow: true
    pii_mask: [email, phone]

2. Add Megent to your function:

import megent as mg

mg.configure(policy_path="megent.yaml")

@mg.guard
def send_email(to: str, body: str) -> str:
    return "sent"

send_email("[e-mail]", "Call me at [phone]")

3. Run your app. Calls are now policy-checked, and sensitive fields are masked automatically.

---

Quickstart

Drop-in decorator

import megent as mg

mg.configure(policy_path="policies/agent.yaml")

@mg.guard
def send_email(to: str, subject: str, body: str) -> str:
  # your tool implementation
  return "sent"

send_email(
  to="[e-mail]",
  subject="Daily summary",
  body="Contact me at [e-mail]",
)

Wrap an existing agent

import megent as mg

runtime = mg.Runtime(policy_path="policies/agent.yaml")

safe_execute = mg.wrap(
  third_party_agent.execute,
  runtime=runtime,
  tool_name="agent_execute",
)

safe_execute(task="Summarize latest reports")

That's it. Megent intercepts every tool call, evaluates it against your policy, and either allows, denies, or modifies it — all without changing your agent code.

---

Policy Language

Policies are plain YAML. No DSL to learn.

# policies/agent.yaml
version: "1"
default_action: deny
pii_mask: [email]

tools:
  read_file:
    allow: true

  send_email:
    allow: true
    pii_mask: [email, phone, ssn]

  delete_all_data:
    allow: false

---

Agent Identity (JWT)

Megent can attribute calls to an agent identity using a JWT (HS256). Set MEGENT_JWT_SECRET (or pass secret= to verify_agent_token) and include agent_id (or sub) in the token claims.

import megent as mg

runtime = mg.Runtime(policy_path="policies/agent.yaml")
token = "<jwt-from-your-auth-system>"

safe_send = mg.wrap(send_email, runtime=runtime, tool_name="send_email", agent_token=token)
safe_send(to="[e-mail]", subject="Ping", body="hello")

---

Audit Log

Every decision is logged in structured JSON.

{
  "event": "allow",
  "tool": "http_post",
  "agent_id": "reports-agent-v2",
  "timestamp": 1767945230.137,
  "args": {
    "body": "[REDACTED]"
  },
  "masked_fields": ["email"]
}

Pipe to any SIEM. Query with any log tool.

---

Framework-agnostic

Megent is not a plugin for LangChain, CrewAI, or any other framework. It is an independent security layer.

You build your agent on whatever platform you want. Megent wraps it.

┌──────────────────────────────────────┐
│              MEGENT                  │  ← security layer (this is us)
│  ┌────────────────────────────────┐  │
│  │   your agent (LangChain,       │  │  ← built on any framework
│  │   CrewAI, OpenAI Agents SDK,   │  │
│  │   raw Python, anything)        │  │
│  └────────────────────────────────┘  │
└──────────────────────────────────────┘

Megent doesn't know or care what your agent is built on. It intercepts tool calls at the boundary — before execution — regardless of the underlying platform.

import megent as mg

# agent built on LangChain? wrap it.
safe_agent = mg.wrap(langchain_agent.invoke, runtime=mg.Runtime(policy_path="policies/agent.yaml"))

# agent built on CrewAI? wrap it.
safe_agent = mg.wrap(crew.kickoff, runtime=mg.Runtime(policy_path="policies/agent.yaml"))

# raw Python agent? same thing.
safe_agent = mg.wrap(my_agent.run, runtime=mg.Runtime(policy_path="policies/agent.yaml"))

The platforms (LangChain, CrewAI, OpenAI Agents SDK, AutoGen, LlamaIndex) are where agents are built. Megent is where they are secured. These are separate concerns.

---

Threat Coverage

Attack	Megent Defense
Unauthorized tool calls	Per-tool allow/deny policy enforcement
Unknown-by-default execution	default_action: deny for explicit allowlists
PII leakage in arguments	Configurable regex masking (pii_mask)
Unattributed execution	Optional JWT-based agent_id attribution
Weak observability	Structured audit events via standard logging

---

---

Contributing

Megent is Apache 2.0 licensed and open to contributions.

git clone https://github.com/Megents/Megent.git
cd megent
pip install -e ".[dev]"
pytest

See CONTRIBUTING.md for guidelines.

---

License

Apache 2.0 — free to use, modify, and distribute.

---

Built for production AI. Designed for developers who ship.

megent.dev