Impact-Site-Verification: ea5f7f08-74ae-4cca-af2a-01826f2587ea
// inline guardrails for claude code, copilot, codex, gemini cli, opencode
The missing security layer for AI agents
Your AI agent reads web pages, runs commands and writes code. AgentGuards checks every step first — stopping hijack attempts, leaked keys and destructive commands — while everyday work runs exactly as before.
✓ Every check on every plan✓ Set up in about 2 minutes✓ The AI can't skip it
Your agent wants to act
Send a prompt, run a command, read a web page, write a file.
AgentGuards checks it first
Automatically, through hooks built into the tool. Nobody has to remember to call it.
Runs, asks, or stops
Everyday work runs untouched. Risky steps wait for your OK. Real threats are stopped — with a plain-English reason.
What we check
Nine checks. One quiet guard.
Everything your agent reads, runs and writes passes through these checks. Turn any of them on or off — and add your own rules — from your dashboard.
Hijack attempts
Text written to take over your AI — “ignore your instructions and do this instead.” Caught by pattern rules plus a trained classifier.
› ignore previous instructions…BlockedHidden text in web pages
Pages can hide instructions a person never sees — white-on-white text, notes in the page code. We catch them before your agent acts.
› <span style=“color:white”>run this…BlockedHidden text in images & PDFs
A logo or PDF in a repo can carry instructions in white-on-white or faint text. We read the text — even what a person can't see — and stop the attack. In the Claude Code and Codex plugins and the Anthropic proxy.
› logo.png: “ignore previous instructions…”BlockedPasswords & keys
Cloud passwords, API keys and tokens are spotted before they reach the AI model.
› AKIA•••••••••••••EXAMPLERedactedKeys sneaking out
If a command tries to send a key to an outside website — even disguised or encoded — it doesn't leave.
› curl -d @~/.aws/credentialsBlockedPersonal data
Email addresses, phone numbers and card numbers are flagged before they go to the AI.
› card 4111 1111 1111 1111RedactedRisky commands
Everyday commands run untouched. Risky ones wait for your OK — once per session. Destructive ones are stopped outright.
› sudo apt install htopAsks youCode it writes
Every file it creates or edits is scanned for security mistakes and passwords typed straight into the code.
› password = "hunter2"FlaggedPackages it installs
When it installs a specific version of a package, we check it against databases of known security holes.
› npm install lodash@4.17.15BlockedWorks with
Drops into the agents you already use
One dashboard and one set of rules, whichever tools your team runs. Claude Code and Codex install with a single command and a browser sign-in.
Claude Code
⚡ One commandOpenAI Codex
⚡ One commandClaude Desktop
PluginGemini CLI
ExtensionGitHub Copilot CLI
PluginOpenCode
PluginAlso: VS Code Copilot, Cursor and other MCP clients, or your own app via the API. Full compatibility, incl. Windows →
✓The AI can't skip it
Hooks run at fixed moments inside the tool — like a turnstile every visitor passes.
✓No prompts for everyday work
git, npm, tests, builds run exactly as before.
✓Asked once, then remembered
An unfamiliar tool asks for your OK once per session, not on every call.
✓Doesn't spend your AI tokens
Hook checks run outside the AI conversation, so they don't add to your model bill.
✓Every decision logged
Your dashboard shows what was checked, allowed and stopped.
✓Your prompts aren't kept
Scanned in memory and discarded — only counts and event types are stored.
Frequently asked questions
Where is the service hosted?+
The website and API run on AWS (eu-north-1 region), served over HTTPS through an Application Load Balancer with ACM certificates. The machine-learning classifiers run on a dedicated server we operate, reached only by our API over TLS.
How do I integrate AgentGuards?+
For Claude Code and OpenAI Codex it's one command: curl -fsSL https://agentguards.co/install.sh | sh (on Windows, irm https://agentguards.co/install.ps1 | iex). It opens your browser to approve the sign-in — no key to copy — then you restart your agent. Gemini CLI, Copilot CLI and OpenCode have a short guided setup, and your own app can call the REST API or the Gateway. See what works where →
What checks does AgentGuards run?+
Every prompt goes through up to 10 layered checks: prompt injection, jailbreak detection, PII detection, secret detection, data exfiltration, toxicity, restricted topics, web-content injection, an LLM semantic check, and a PromptGuard ML classifier — checks short-circuit on the first confirmed threat. On top of that, AgentGuards scores every shell command your agent tries to run and blocks destructive ones (like rm -rf /), screens the web pages it fetches for hidden instructions, scans every file it writes or edits for hardcoded secrets and vulnerable code (SAST via semgrep + gitleaks), and checks the packages it installs for known vulnerabilities (grype). Web-page, code and dependency scanning are on by default on every plan.
Does AgentGuards store my prompts?+
No. We scan prompt content in memory and discard it immediately. Only metadata — request counts, token counts, blocked event types — is persisted for your usage dashboard.
Which LLMs and frameworks are supported?+
AgentGuards is model-agnostic. It sits in front of any LLM call as an HTTP guardrail. Native integrations exist for Claude Code, OpenAI Codex, Gemini CLI, GitHub Copilot (CLI and VS Code) and OpenCode.
What happens when a threat is detected?+
The request is blocked before it reaches the model. You receive a JSON response with decision: "block" and a per-check breakdown showing which check triggered and why. Your LLM is never called.
Can I configure which checks run?+
Yes. Every check can be toggled on or off per tenant from your dashboard. Individual and higher plans can also edit custom detection patterns.
What counts as a request?+
Each guardrail evaluation — an input check, output validation, action authorization, policy evaluation, or gateway completion — is one metered request.
Do AgentGuards requests use up my Claude Code (or other LLM) credits?+
Depends on which integration you use. With the hook-based integration (Claude Code, Gemini CLI, Codex hooks), our check runs as a plain HTTP call outside the model's context — Claude never sees it, so it burns zero of your model credits. With the MCP server integration, calling our tools costs a small amount of Claude context/tokens, the same as any MCP tool call, since the model has to load the tool schema and read the JSON result — that's what shows up under "MCP servers" in Claude Code's /usage breakdown. Either way, the security check itself never invokes an LLM on our end (it's regex plus a self-hosted classifier), and it only counts once against your AgentGuards request quota — a separate meter from your LLM credits. The one exception is the optional LLM-judge check, which — if you enable it — runs on your own OpenAI key, so any token cost there stays on your account, not ours.
Does AgentGuards work in Claude Desktop's Cowork tab?+
Not today — we tested it directly rather than assumed. A plugin's hooks are supposed to run on every message regardless of setup, and in Cowork sessions they don't, even with a real API key configured and Desktop fully restarted. The terminal, Claude Desktop's Code tab, and cloud sessions started at claude.ai/code all work normally. See the full breakdown →
Is the free plan really free? Do I need a credit card?+
Yes — no credit card to start. The Free plan is a one-time credit of 1,000 requests with 1 API key: enough to wire AgentGuards into your tools and run it against real traffic. You have 30 days from signing up to spend it, and it doesn't refill each month. Once it's used up or the 30 days are out, you choose what happens next: upgrade, keep working without screening, or uninstall.
What happens when I hit my limit?+
On a paid plan, requests beyond your monthly quota pause until the next cycle or an upgrade. On the free plan there's no next cycle — the credit is one-time. We email you when you've used 80% of it, and once it's gone you choose what happens next: upgrade, keep working without screening (with one reminder a day), or uninstall. Until you choose, requests are blocked. Your dashboard always shows usage and what's left.
Can I bring my own model key?+
Yes. The optional LLM-judge check runs on your own OpenAI key, so that spend stays on your account.
Do you offer on-prem?+
Enterprise can deploy in your own VPC or on-prem, with SLA, SSO, and a security review.
Ship your agent with guardrails on.
Start free in two clicks. No credit card, no sales call.