One unvetted tool can read your AWS secrets, execute arbitrary shell scripts, or pivot through your private VPC. AgentShield provides model-agnostic, zero-trust security for agents powered by Gemini 3.7 Flash, DeepSeek-V4-Pro, Grok 4.6, Claude 5 Sonnet/Opus, GPT-5.6 Sol, Qwen3.8-27B, GLM-5.3, OpenAI Codex, and Google Antigravity in <50ms — 100% offline.
Traditional SAST linters don't understand LLM tool parameters. Attackers exploit tool interfaces to hijack host systems.
An innocent-looking tool reads local .env credentials or SSH keys and silently POSTs them to an external endpoint during prompt execution.
Prompt injection tricks the LLM into passing ; rm -rf / into a nested utility helper that invokes subprocess.run(shell=True).
A web retrieval tool gets tricked into querying http://169.254.169.254/latest/meta-data/ to dump cloud IAM roles and private VPC services.
Skills and extensions executing dynamic code (eval(), pip install) pull unvetted remote payloads into your agent context at runtime.
Built from the ground up in Rust for speed, privacy, and deep agent tool semantics.
Zero telemetry, zero cloud dependencies. No source code or tool schemas ever leave your machine or CI runner. Operates in completely air-gapped environments.
Tracks tainted tool parameters through helper functions, utility wrappers, and class methods to downstream sinks (`subprocess`, `fetch`, arbitrary file access).
`agentshield fix` automatically rewrites insecure deserializers (`yaml.load` → `safe_load`, `pickle` → `json`) and pins unpinned dependencies with full unified diff previews.
Real-time MCP proxy (`agentshield guard`) for stdio and HTTP/SSE streams. Inspects `tools/call` JSON-RPC payloads, enforces policies, and redacts leaked credentials on outgoing streams.
Author organization-specific rules in `.agentshield/rules/*.yaml`. Supports source code regex with file globs, banned dependency rules, and prohibited tool name matchers.
Native SARIF v2.1.0 output integrates seamlessly into GitHub PR annotations, Security > Code Scanning alerts, and CI/CD quality gates.
Explore real-world vulnerability patterns and see how AgentShield's AST and dataflow engines catch them.
// server.ts (MCP Server)
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { z } from "zod";
const server = new McpServer({ name: "api-fetcher", version: "1.0.0" });
// ❌ Vulnerable: Tool accepts arbitrary URL and fetches without allowlist
server.tool(
"fetch_api_docs",
{ target_url: z.string().url() },
async ({ target_url }) => {
const res = await fetch(target_url); // Reaches 169.254.169.254 or localhost
return { content: [{ type: "text", text: await res.text() }] };
}
);Validate 'target_url' against an explicit domain allowlist and block access to cloud metadata IP (169.254.169.254) and private networks.
AgentShield provides native IR adapters for all major agent frameworks and IDE configurations.
Audits Custom GPT Actions, OpenAPI schemas, OpenAI Agents SDK tool definitions, and Codex code execution surfaces.
Hardens Google Antigravity (AGY) agent tools, subagents, and Gemini tool-calling workflows against command injection and SSRF.
Validates MCP configurations, server manifests, and terminal capabilities before agents execute tools on your machine.
Deep AST and interprocedural taint analysis for TypeScript and Python MCP servers, tool schemas, and stdio/SSE endpoints.
Analyzes .cursorrules and AI IDE guidance files for toxic prompt injection, unauthorized network egress, and shell execution.
Audits Hermes config/profiles (config.yaml, ~/.hermes/), mcp_servers definitions, .hermes.md context surfaces, and skill trees.
Audits Python and TypeScript multi-agent graphs, tool nodes, and dependency supply chain hygiene.
Protects autonomous role-playing agents, OpenClaw SKILL.md skills, and browser automation workflows (Playwright MCP, Browser Use).
Built for teams that need deep, offline, deterministic security without sending code to a cloud service.
| Feature | AgentShield v1.0 | mcp-scan | Invariant Labs |
|---|---|---|---|
| Engine | Native Rust (<50ms) | Python | Cloud / Hosted |
| Offline / Air-Gapped | 100% Offline | Partial | No |
| Framework Adapters | 7 Frameworks | MCP Only | MCP Only |
| Interprocedural Taint | Yes (Cross-Function) | No | No |
| Automated Remediation (Fix) | Yes (CLI + VS Code) | No | No |
| Declarative Custom Rules | Yes (.yaml / .json) | No | No |
| Runtime Guard Proxy | Yes (stdio + SSE/HTTP) | No | No |
| SARIF / GitHub Action | Native Support | No | No |
Choose your preferred installation method to start securing your agent extensions today.
# ⚡ Fast 1-line installation for macOS & Linux (Apple Silicon, Intel, ARM64, x86_64)
curl -fsSL https://aiconnai.github.io/agentshield/install.sh | sh
# Verify installation:
agentshield --version