Agent Security

Open source alternative to Lakera Guard and Zenity

157 stars
Apache-2.0
Active this week
Last commit today

Last verified Oct 28, 2026

Secure AI coding agents at the execution layer with local-first policy enforcement, DLP scanning, and a tamper-evident audit trail. Apache 2.0.

Visit website GitHub157

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Agent Security is for#

Development teams running AI coding agents on sensitive codebases

Teams working with codebases that contain API keys, database credentials, or customer data need controls over what their AI agents can read and upload. Agent Security blocks tool calls that would expose secrets or access protected paths, and leaves a per-session audit trail that security teams can review after the fact.

Skip if:

Your agents run in isolated environments with no access to production credentials or sensitive files. If the threat model is prompt injection rather than data exfiltration at the execution layer, Agent Security addresses the latter but not the former.

Security engineers adding AI governance to their organization's agent use

Security teams that need to enforce consistent policies across all developer AI sessions can deploy Agent Security on every developer machine. The policy file is version-controlled and shareable, and the local audit trail records every decision for post-incident review. `solongate doctor` and `solongate repair` help maintain the guard across updates.

Skip if:

Your organization needs centralized policy management from a single control plane, real-time alerts to a SIEM, or audit logs aggregated across machines. Agent Security's audit trail is local per machine with no built-in aggregation.

Solo developers who want audit visibility into their own agent sessions

A single developer running Claude Code or Codex CLI can install Agent Security to get a record of every file the agent touched, every network call it made, and every secret pattern it encountered. The TUI and live watch mode make the audit trail browsable without additional tooling, and `solongate trace` shows what happened in a specific directory.

Skip if:

You are comfortable with the agent's access scope and do not need an audit trail or access controls. For developers who want to give their agent maximum latitude without policy friction, Agent Security adds overhead without benefit in that context.

Teams with air-gapped or data-sovereignty requirements

Because Agent Security makes no network calls during normal operation, it works in environments where routing agent traffic through a third-party cloud service is not permitted. The policy is a local file, the audit trail is a local file, and no telemetry leaves the machine. Cloud logging is opt-in and disabled by default.

Skip if:

Your requirements include centralized cloud logging, team-wide dashboards, or cross-machine policy sync. These are features of the SolonGate commercial product, not the open source Agent Security gateway.

the problem

The problem it solves#

AI coding agents operate with broad access to filesystems, network calls, and external services. An agent asked to help with code can read credential files, upload data to external endpoints, or write to paths far outside the project directory. Standard security controls at the model level, such as prompt engineering and output filtering, do not address the execution layer: an agent instructed to be careful can still read a .env file; output filtering cannot see what a file-read call returns before it executes.

For teams running multiple developers with AI coding tools, the challenge compounds. There is no central record of what agents accessed across sessions, no consistent policy applied to all of them, and no audit trail to review after the fact. Today the choice is between no controls at all and routing agent traffic through a cloud-based service, which raises data-sovereignty and latency concerns of its own.

how Agent Security solves it

How it solves it#

Policy-based tool call enforcement

Every tool call an AI coding agent makes passes through the guard before execution. Policies allow or deny by path, command, filename, or URL, scoped to READ, WRITE, EXECUTE, or NETWORK operations. The decision is made on-device in milliseconds, and the result is written to the local audit trail regardless of outcome.

Built-in DLP with 70+ secret patterns

The data loss prevention layer scans for 70+ secret families including AWS keys, OpenAI keys, Stripe keys, JWTs, private keys, IBANs, passports, national IDs, and phone numbers. Patterns run in four modes: off, detect, redact, or block. In block mode, the guard also scans the content of files being uploaded, catching secrets that would not appear in the tool call parameters alone.

Tamper protection and protected paths

The guard's own state is unreachable from a tool call, and a policy file stored in a repository cannot disable the guard. Protected paths are enforced at the OS level rather than by matching words in a tool call, which means an agent that receives instructions to bypass the policy cannot do so. The .last-deny flag records the last blocked call.

Sandbox mode with a minimal filesystem

Sandbox mode gives the agent a new, minimal filesystem containing only the project directory. Files and paths outside that boundary are not refused; they are simply not present. This removes an entire class of path-traversal attacks where a policy rule would have to correctly anticipate every sensitive path to block access.

Local audit trail and live monitoring CLI

Every tool call decision is written to a local tamper-evident audit trail. The CLI includes `solongate audit` (browse past decisions), `solongate watch` (live tail of tool calls as they happen), and `solongate trace` (show what the guard saw in a specific directory). No data leaves the machine unless cloud logging is explicitly enabled.

strengths · trade-offs

Strengths and trade-offs#

Strengths

No outbound dependency during normal operationThe guard makes no network calls during normal operation. Policies are a file, the audit trail is a file, and all decisions are made on-device. This means the guard works in air-gapped environments and never routes agent traffic through a third-party server. Unlike cloud-based guardrails that require API keys and live internet access, Agent Security functions without any external service.
Benchmark-verified secret detection rateSolonGate published a benchmark against Presidio, trufflehog, and gitleaks on 1,890 real pastes carrying 4,930 marked secret values. Agent Security detected 94.7% of pasted secrets and personal data, 51 percentage points ahead of the next best tool (Presidio at 43.7%). It also decodes base64-encoded values before scanning, catching obfuscated secrets that all three competing tools missed entirely.
Apache 2.0 license, no per-seat pricingAgent Security is Apache 2.0 licensed. Teams can run it on any number of developer machines, modify it for their environment, and use it in commercial contexts without licensing fees. There is no per-seat model, no enterprise tier required for policy management, and no account required to use the tool.
OpenSSF and SLSA supply-chain security certificationsThe repository carries OpenSSF Best Practices Passing, Silver, and Gold badges, SLSA Build Level 1, 2, and 3 attestations, and an OpenSSF Allstar certification. These are independently verified security postures for open source projects, alongside a SonarCloud quality gate, code coverage badge, and REUSE compliance status listed in the repository's README.

Trade-offs

-Very new project with 86 open issuesThe repository was created in September 2026 and has 86 open issues, a high count relative to its size and age. For teams considering production adoption, the issue tracker is worth reviewing to understand which represent feature requests versus bugs or missing documentation. The core guard binary and CI pass, but the project has not yet built the long track record that older security tools carry.
-Requires Go 1.26 and a manual install scriptInstallation requires Go 1.26+ and running an install script from the cloned repository. There is no Docker image, no package manager entry (apt, brew, or nix), and no binary download from a package registry. Developers on managed machines or locked-down environments may not be able to run the install script without additional permissions.
-No centralized dashboard for team-wide policy managementThe CLI and local TUI cover individual developer sessions well. For teams that need centralized policy management from a single control plane, a shared audit log aggregated across multiple machines, or SIEM integration, Agent Security does not currently offer those surfaces. Teams with those requirements may need to supplement with additional tooling or evaluate the SolonGate commercial product.

versus alternatives

Agent Security vs alternatives#

Agent Security vs Lakera Guard

Lakera Guard is a managed API service that sits between an application and an LLM to detect prompt injections, harmful content, and PII in the model's inputs and outputs. Agent Security operates at a different layer: it intercepts the tool calls an AI coding agent makes (file reads, writes, network requests) before they execute, enforcing access policies on the filesystem and network rather than filtering the model's conversation.

Feature	Agent Security	Lakera Guard
License	Apache 2.0	Proprietary
Deployment	On-device, no account required	Managed cloud API
What it intercepts	Tool calls (filesystem, network)	LLM inputs and outputs
Secret detection	94.7% detection rate on real pastes	Not published
Self-hosting	Yes, local install	No
Pricing	Free	Paid plans

Agent Security is the better choice when the concern is what an agent does at the execution layer: reading .env files, uploading data, or writing to protected paths. Lakera Guard is the better fit when the requirement is prompt injection detection or PII filtering in the model's conversation context, which is a threat surface Agent Security does not address.

Agent Security vs Zenity

Zenity is an enterprise AI governance platform focused on visibility into shadow AI use, policy controls for AI assistants, and compliance reporting for security and risk teams. It operates through cloud-side infrastructure to monitor and govern AI tool use across an organization.

Feature	Agent Security	Zenity
License	Apache 2.0	Proprietary
Deployment	On-device	Cloud-based enterprise platform
Primary focus	AI coding agent execution layer	Enterprise AI governance and shadow AI visibility
Self-hosting	Yes	No
Centralized team dashboard	No (local audit trail per machine)	Yes
Pricing	Free	Enterprise pricing

Agent Security is the better choice for development teams that need per-session audit trails and access controls for AI coding agents without cloud routing or enterprise procurement. Zenity is better suited to security and risk teams that need organization-wide visibility into all AI tool usage, including browser-based AI assistants, with centralized reporting and compliance features. The two tools address different buyers and different threat models.

install · quick start

Quick start#

bash

Install Agent Security by cloning the repository and running the setup script.
```bash
git clone https://github.com/solongate/agent-security.git
cd agent-security
./scripts/install.sh
solongate
```

tech stack · detected from GitHub

What it's built on#

Languages: Go

frequently asked

FAQ#

Is Agent Security free to use?

Yes. Agent Security is Apache 2.0 licensed and free to run on any number of machines. There is no account required, no cloud dependency, and no per-seat pricing. The open source repository includes the full guard binary, CLI, and policy engine with no feature gating.

Which AI coding agents does Agent Security support?

Agent Security currently supports Claude Code, Codex CLI, Antigravity CLI, and OpenCode. The guard works with any MCP-speaking agent out of the box. Support for OpenClaw, Hermes, and Chainabit is listed as coming soon in the repository.

Does Agent Security send my code or secrets to the cloud?

No. The guard makes no network calls during normal operation. Every policy decision, DLP scan, and audit record is processed and stored on-device. Cloud logging is available but opt-in; it is disabled by default and must be explicitly enabled in the settings.

How does Agent Security differ from prompt-level guardrails like Lakera Guard?

Prompt-level guardrails scan the inputs and outputs to the language model. Agent Security operates at the execution layer, intercepting tool calls (file reads, writes, network requests) before they run. These address different threat surfaces: a prompt filter cannot see what a file-read call returns before it is used; Agent Security blocks the file-read itself if it matches a policy rule.

Can a compromised AI agent disable Agent Security?

No. The guard's own state is unreachable from a tool call, and a policy file stored in a project repository cannot switch the guard off. Protected paths are enforced at the OS level rather than by matching text in a tool call, so an agent that receives instructions to bypass the policy cannot execute them.

also worth a look

Similar open-source tools#

iFixAi

Alternative toZenity

Self-hosted AI agent auditing across 60 trust and safety inspections.

35,128 GitHub stars
Licence Apache-2.0

Doberman-Core

Alternative toZenity

Runtime guardrails that gate every AI agent tool call

275 GitHub stars
Licence Apache-2.0

Oya Browser

Alternative toBrowserbase

Records portal tasks once; replays with no model and no bot detection

355 GitHub stars
Licence Sustainable Use License 1.0

Promptfoo

Alternative toBraintrust

Automated LLM evals, red teaming, and AI vulnerability scanning.

26,422 GitHub stars
Licence MIT

Bifrost

Alternative toPortkey

Open-source AI gateway with 23+ providers, failover, and MCP support.

9,132 GitHub stars
Licence Apache-2.0

ClawTrace

Alternative toLangSmith

Visualize agent execution trees and track token costs per step

47 GitHub stars
Licence Apache-2.0

by category

Open source tools in these categories#

141

12,826 GitHub stars
Licence AGPL-3.0
#Email

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

3,296 GitHub stars
Licence Apache-2.0
#AI Agents

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

5,914 GitHub stars
Licence Apache-2.0
#AI Agents

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Agent Security vs Lakera Guard

Feature	Agent Security	Lakera Guard
License	Apache 2.0	Proprietary
Deployment	On-device, no account required	Managed cloud API
What it intercepts	Tool calls (filesystem, network)	LLM inputs and outputs
Secret detection	94.7% detection rate on real pastes	Not published
Self-hosting	Yes, local install	No
Pricing	Free	Paid plans

Agent Security vs Zenity

Feature	Agent Security	Zenity
License	Apache 2.0	Proprietary
Deployment	On-device	Cloud-based enterprise platform
Primary focus	AI coding agent execution layer	Enterprise AI governance and shadow AI visibility
Self-hosting	Yes	No
Centralized team dashboard	No (local audit trail per machine)	Yes
Pricing	Free	Enterprise pricing

Who Agent Security is for#

Development teams running AI coding agents on sensitive codebases

Skip if:

Security engineers adding AI governance to their organization's agent use

Skip if:

Solo developers who want audit visibility into their own agent sessions

Skip if:

Teams with air-gapped or data-sovereignty requirements

Skip if:

The problem it solves#

How it solves it#

Policy-based tool call enforcement

Built-in DLP with 70+ secret patterns

Tamper protection and protected paths

Sandbox mode with a minimal filesystem

Local audit trail and live monitoring CLI

Strengths and trade-offs#

Strengths

Trade-offs

Agent Security vs alternatives#

Agent Security vs Lakera Guard

Agent Security vs Zenity

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

AI & Machine Learning

LLMOps & AI Tooling

Find open source alternatives to paid software

Who Agent Security is for#

Development teams running AI coding agents on sensitive codebases

Skip if:

Security engineers adding AI governance to their organization's agent use

Skip if:

Solo developers who want audit visibility into their own agent sessions

Skip if:

Teams with air-gapped or data-sovereignty requirements

Skip if:

The problem it solves#

How it solves it#

Policy-based tool call enforcement

Built-in DLP with 70+ secret patterns

Tamper protection and protected paths

Sandbox mode with a minimal filesystem

Local audit trail and live monitoring CLI

Strengths and trade-offs#

Strengths

Trade-offs

Agent Security vs alternatives#

Agent Security vs Lakera Guard

Agent Security vs Zenity

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

AI & Machine Learning

LLMOps & AI Tooling

Find open source alternatives to paid software