Agentguard

Securing AI Agent Operations

AI coding agents (Claude Code, Cursor, Codex, OpenCode, Cline) are increasingly given shell access to run commands, edit files, and install dependencies — but each one has its own, inconsistent way of expressing what it's allowed to do. Agentguard defines that policy once, as a single YAML file, and compiles it into the native instruction format each agent platform actually understands.

How It Works

A policy file declares rules for commands, file paths, and dependency changes, each resolving to allow, deny, or approval-required (deny takes precedence over approval, which takes precedence over allow). Agentguard's compiler turns that one policy into agent-specific config for five platforms — Codex, Claude Code, Cursor, OpenCode, and Cline — so the same guardrails apply no matter which agent a project uses. A CLI wrapper then intercepts and runs commands against those rules directly, rather than relying on the agent to self-police.

Key Features

• One policy, five agent platforms: write the rules once; the compiler generates the native format for each supported agent.
• Guarded command execution: shell-style glob matching against an allow/deny/approval-required rule set, with deny always winning.
• Session logging: every guarded session is captured with before/after state, exportable as Markdown, HTML, or JSON.
• Change monitoring and rollback: git diff tracking on protected paths and dependency manifests, with the ability to reverse a session's changes.
• Starter profiles: production-strict, fast-prototype, and junior-helper ship as ready-made policies for different risk tolerances.

Stack

Python CLI, PyYAML for policy parsing — deliberately minimal dependencies (the test suite only needs the standard library plus PyYAML). Session state is captured to .agentguard/sessions/ for diffing and rollback.