Sub-millisecond runtime firewall for AI agents.

Q: Why run deterministic security checks instead of an LLM guard model?

Probabilistic LLM judges add 300–1200 ms of latency and can themselves be tricked by adversarial prompts. AgentShield enforces deterministic regex, decoding, AST/argument, and policy invariants under 0.15 ms with zero external API keys.

Q: How does AgentShield protect Python tools and MCP tool calls?

Wrap callables with @guard_tool(runtime) or call ShieldedAgentRuntime adapters for OpenAI and Anthropic/MCP tool calls. Untrusted contexts cannot escalate into privileged tools, and human-approval callbacks pause sensitive actions.

Q: How does the audit ledger detect tampering?

AuditLedger hashes every decision sequentially using SHA-256 previous-hash chaining. Running verify_integrity() exposes any modified summary, forged entry, or missing row.

OWASP 2026 protection across prompt ingestion, shell/filesystem/SQL/SSRF tool calls, egress DLP redaction, and SHA-256 audit chaining.

$ uv run agentshield evaluate --output report.md

Open Studio →

OWASP Suite25 / 25

Attack Recall100.0%

False Positives0.0%

Median Check< 0.15 ms

LLM01 & LLM08 Blocked: Detects direct overrides, ChatML control token spoofing, Base64/Hex obfuscation, zero-width steganography, and HTML RAG poisoning.

Zero external API calls · FastAPI Security Lab · @guard_tool & MCP adapters Test Payloads Live 25-Scenario Report

Injection Defense

Inspects user messages and retrieved RAG chunks for direct jailbreaks, Base64/Hex payloads, ChatML delimiters, and zero-width Unicode hiding.

Capability Firewall

Deep argument inspectors block shell command chaining, filesystem path traversal outside workspaces, cloud metadata SSRF, and stacked SQL queries.

Egress DLP Redaction

Automatically scrubs leaked provider keys, private keys, JWTs, DB connection strings, PII, and XSS payloads prior to reaching the caller.

SHA-256 Audit Ledger

Append-only hash-chained ledger records every allow, deny, and require_approval decision with verify_integrity() verification.

OWASP 2026 Defense Architecture

Four deterministic defense stages protecting prompts, tool arguments, tool responses, and audit history.

LLM01 Prompt

LLM08 RAG

ASI02 Tools

LLM02 DLP

LLM06 Gates

SHA-256 Log

Test payloads live in Studio, browse all 25 scenarios in Benchmark, or explore the OWASP Matrix.

Frequently Asked Questions

Why run deterministic security checks instead of an LLM guard model?

Probabilistic LLM judges add 300–1200 ms latency and remain susceptible to adversarial bypasses. AgentShield enforces deterministic parsing, decoding, and policy invariants under 0.15 ms with zero external API keys.

How does AgentShield protect Python tools and MCP tool calls?

Decorate any tool with @guard_tool(runtime) or pass OpenAI/Anthropic/MCP tool payloads through ShieldedAgentRuntime. Untrusted RAG contexts cannot trigger privileged tools.

How does the audit ledger detect tampering?

AuditLedger appends sequential SHA-256 hash-linked entries. Calling verify_integrity() detects tampered summaries, altered parameters, or deleted audit entries immediately.