agentward-ai/agentward

Secure every agent action — from install to runtime.
Source-available security platform for AI agents.
---
Telling an agent *"don't touch the stove"* is a natural-language guardrail that can be circumvented. AgentWard puts a **physical lock on the stove** — code-level enforcement that prompt injection can't override.
AgentWard sits between AI agents and their tools (MCP servers, HTTP gateways, function calls) to enforce least-privilege policies, inspect data flows at runtime, and generate compliance audit trails. Policies are enforced **in code, outside the LLM context window** — the model never sees them, can't override them, can't be tricked into ignoring them.
Why AgentWard?
AI agents now have access to your email, calendar, filesystem, shell, databases, and APIs. The tools exist to *give* agents these capabilities. But **nothing exists to control what they do with them.**
| What exists today | What it does | What it doesn't do |
|---|---|---|
| **Static scanners** (mcp-scan, Cisco Skill Scanner) | Scan tool definitions, report risks | No runtime enforcement. Scan and walk away. |
| **Package scanners** (Snyk, Socket) | Flag known-vulnerable packages | Don't inspect .pth files or install-time code execution vectors. |
| **Guardrails frameworks** (NeMo, Guardrails AI) | Filter LLM inputs/outputs | Don't touch tool calls. An agent can still rm -rf /. |
| **Prompt-based rules** (SecureClaw) | Inject safety instructions into agent context | Vulnerable to prompt injection. The LLM can be tricked into ignoring them. |
| **IAM / OAuth** | Control who can access what | Control *humans*, not *agents*. An agent with your OAuth token has your full permissions. |
The gap: **No tool-level permission enforcement that actually runs in code, outside the LLM, at the point of every tool call.** Scanners find problems but don't fix them. Guardrails protect the model but not the tools. Prompt rules are suggestions, not enforcement.
AgentWard fills this gap. It's a proxy that sits between agents and tools, evaluating every tools/call against a declarative policy — in code, at runtime, where prompt injection can't reach.
Prerequisites
AgentWard scans and enforces policies on your existing AI agent tools. You need **at least one** of:
- **Cursor** with MCP servers configured
- **Claude Desktop** with MCP servers configured
- **VS Code** with MCP servers (Copilot or extensions)
- **Windsurf** with MCP servers configured
- **OpenClaw** with skills installed
No MCP servers yet? AgentWard can also scan Python tool definitions (OpenAI, LangChain, CrewAI) in any project directory.
Quick Start
That's it. agentward init scans your tools, shows a risk summary, generates a recommended policy, and wires AgentWard into your environment. Most users don't need anything else.
If you want more control, you can run each step individually. AgentWard follows a five-step security lifecycle:
- **SCAN** — discover tools, classify risk, detect supply chain threats before runtime
- **CONFIGURE** — generate a policy tailored to what scan found
- **ENFORCE** — run the proxy; every tool call evaluated against policy in code
- **VERIFY** — fire adversarial probes through the engine, confirm policies block what they should
- **MONITOR** — audit trail in JSON Lines and RFC 5424 syslog for SIEM integration
1. Scan your tools
Auto-discovers MCP configs (Claude Desktop, Cursor, Windsurf, VS Code), Python tool definitions (OpenAI, LangChain, CrewAI), and OpenClaw skills. Outputs a permission map with risk ratings, skill chain analysis, security recommendations, developer fix guidance, and **compliance-framework hints** — when scan detects PHI, financial, trading, personal-data, or cardholder-data patterns, it surfaces the relevant frameworks (HIPAA / GDPR / SOX / PCI-DSS / DORA / MiFID II) and the exact agentward comply --framework command to evaluate against them. A markdown report (agentward-report.md) is saved automatically.
The scanner also runs **pre-install security checks** on skill directories before you install them — catching threats at the supply chain stage, before they can execute code at runtime:
- **Deserialization attack detection** (CRITICAL) — identifies pickle.loads, yaml.load, Java deserialization, and PHP unserialize calls that can execute arbitrary code when the skill processes agent-controlled input
- **YAML safety analysis** — flags yaml.load without Loader= and bare yaml.unsafe_load calls
- **Executable hook inspection** — checks postinstall, preinstall, and lifecycle scripts for suspicious shell commands (ClawHavoc-style install-time code execution)