Free to run locally

The runtime firewall that keeps AI agents alive.

Block the catastrophic deterministically.Coach the recoverable.

A bulk read of the internal user table, blocked before any data leaves.

Stops your agent before it can: DROP TABLE · $450k wire · SSH-key exfil · rm -rf / · SSRF 169.254.169.254 · 8-hour token loop

Block catastrophic tool calls before they run. No key to start, your data does not leave your machine, and a block hands your agent a safe path to finish, not die on a 403.

Get started freeSee it in action, no install →
How one tool call flows through AgentXA tool call goes from your app into the Shield in process RAM, which hard-blocks catastrophic calls with no key. Clean calls run; novel or obfuscated ones escalate to the gateway judge. The judge sends coaching back to your app code, which revises the call and sends it through the shield again; high-risk cases escalate to the cloud control plane for team approval and audit.HOW ONE TOOL CALL FLOWS THROUGH AGENTXYour agent / app codetool call (the args the LLM built)ShieldIN PROCESS RAM · NO KEYHard-blocks the blatant catastrophiccall before it runs. No key, nothingleaves the process.allowYour tool runsClean call executes.escalate (novel / obfuscated)Gateway judgeYOUR LLM KEYCoaches your agent; it revises andfinishes instead of crashing on a 403.coachingagent revises,calls againescalate high-riskControl planeTEAM · CLOUDHITL / SOC approval, shared audit trail.Shield (free, local)Recover (your key)Control (team)
Pick your pathkeyless · no signup · every path steps up to the gateway
TypeScriptRun · no install

See your risk surface first. Lists every tool your agent can call, ranked by risk, and which are unguarded. Works on Vercel AI SDK and LangChain.js.

npx @agentx-core/scan .

Then bring what it finds to us: the in-process guard runs against the gateway, and we wire it up with you.

Would you rather install a TypeScript guard yourself, with no key and no call with us?

PythonOne decorator

Install the SDK, then drop @agentx_protect on any tool. The dangerous call is blocked in process RAM before it runs, no key.

pip install agentx-security-sdk
from agentx_sdk import agentx_protect

@agentx_protect(agent_id="crm")
def call_api(url):
    return requests.get(url)

# the agent picks the url at runtime:
call_api("http://169.254.169.254/")

Trying it on a live agent? enforcement="audit" records that tool's calls and blocks none. Your other wrapped tools keep enforcing. See it: agentx audit

Step up to the gateway below for the full floor and Recover.

MCPZero codeClaude Code, Cursor

One line in mcp.json wraps any server. The dangerous tools/call never reaches it, and the agent is coached to self-correct keyless.

{
  "mcpServers": {
    "filesystem": {
      "command": "uvx",
      "args": [
        "agentx-mcp", "npx", "-y",
        "@modelcontextprotocol/server-filesystem",
        "/data"
      ]
    }
  }
}

Config uses uvx (no install). Want to watch it block something first?

Trying it on servers you already use? AGENTX_ENFORCEMENT=audit in a server's env records that server's calls and blocks none of them. Add it per server block. Read it back with uvx agentx-mcp --audit.

This is keyless and it is your protection for MCP servers today. Gateway-backed Recover over MCP is on the roadmap.

Want the gateway to cover your MCP traffic too?

The gatewayFree · self-serve

Where the Python and TypeScript paths step up. The full deterministic floor (AST parsing, the SSRF normalizer, the whole failure catalog), coached recovery that finishes the run, and team review before a risky action runs.

The Python decorator and the agentx-mcp proxy run the keyless Shield first, with no key and nothing leaving your machine. The gateway adds the full deterministic floor for Python and TypeScript tools, still with no key; your own Gemini key turns on Recover. Over MCP it is on the roadmap.

Get the gateway, free→

Full quickstart for your language → one numbered path, start to finish.

ShieldFree · Local

pip install, then one decorator on a Python tool or one line in your mcp.json to wrap any MCP server. The keyless Shield blocks the blatant catastrophic calls (DROP TABLE, secret exfiltration, SSRF) before they run, and coaches your agent to self-correct. No LLM key, no signup, runs on your machine.

block + coach

RecoverGateway + Gemini key

The gateway judge catches what keyword rules can't see, writes the safe path when your policy carries none, and runs the coach-and-retry for you, so your agent finishes the task instead of dying on a 403. Needs the gateway and your own Gemini key.

guide + continue

Get the gateway
Control+ Team

Connect the cloud control plane for team human-in-the-loop and SOC approvals, shared dashboards, and a fleet-wide audit trail. Central oversight for when one machine isn't the whole story.

review + govern

Request Access

Need team control?

The gateway is free and self-serve: get it here, no wait. This list is for Control: the cloud control plane with team human-in-the-loop, SOC approvals, and shared dashboards.

One decorator. No boilerplate. Runs on your laptop.

01

Wrap any tool as-is

Drop one lightweight Python decorator, @agentx_protect, over any tool. It reads the function signature automatically, serializes the risky inputs, and ignores connection objects like a SQLAlchemy session. No boilerplate, no payload schemas. (TypeScript uses a thin in-process guard we set up with you.)

02

Enforced in code, not the prompt

Enforced by a dependency-free keyword and intent shield that blocks the blatant compromises right in process RAM, with no gateway or LLM call. Novel or obfuscated threats escalate to the gateway judge for deeper analysis.

03

Local-First, No Signup

Runs entirely on your machine: no LLM key, no account, and your data does not leave your machine. Every intercept commits to a local SQLite ledger first, so it survives restarts and works fully offline. Add your own LLM key only to unlock recovery coaching; link to the cloud control plane only when you want team HITL & SOC.

What AgentX blocks today

The irreversible classes, grouped. The deterministic floor catches them at the execution layer, before the call runs, with zero LLM calls and no API key. Grounded in a catalog of real agent-failure incidents.

Destructive data ops

DROP TABLETRUNCATEDELETE without WHEREALTER DROP COLUMN

Blocked pre-execution

Secret & PII exfiltration

credential / secret readsnamed-PII customer readsexport to external sink

Blocked pre-execution

SSRF & network traversal

169.254.169.254loopback / link-localconfused-deputy fetchmass port scan (nmap)

Blocked pre-execution

Shell, files & cloud teardown

rm -rfpath traversal → /etc/shadowcurl | shterraform destroybucket / volume delete

Blocked pre-execution

Money, comms & dependencies

large transferrunaway spend (budget ceiling)runaway provisioning (fleet ceiling)inbox / bulk wipeexternal publishunverified install

Held for human approval

Runaway loops

no-progress command loopstuck-command repeat

Circuit-broken

…and the agent keeps going

Recover · + your LLM key
Blocked
notes="…; DROP TABLE users;"
Coached

"Destructive write blocked. Scope with a WHERE key or use an aggregate, don't drop the table."

Agent revises
SELECT COUNT(*) FROM users
Continues

The task finishes: no wiped table, no dead run, no wasted tokens.

Block is free with Shield; coached recovery needs your LLM key; team human-in-the-loop approvals run on the cloud control plane.