AgentWard

Secure every agent action — from install to runtime.
Source-available security platform for AI agents.

Telling an agent "don't touch the stove" is a natural-language guardrail that can be circumvented. AgentWard puts a physical lock on the stove — code-level enforcement that prompt injection can't override.

AgentWard sits between AI agents and their tools (MCP servers, HTTP gateways, function calls) to enforce least-privilege policies, inspect data flows at runtime, and generate compliance audit trails. Policies are enforced in code, outside the LLM context window — the model never sees them, can't override them, can't be tricked into ignoring them.

Why AgentWard?

AI agents now have access to your email, calendar, filesystem, shell, databases, and APIs. The tools exist to give agents these capabilities. But nothing exists to control what they do with them.

The gap: No tool-level permission enforcement that actually runs in code, outside the LLM, at the point of every tool call. Scanners find problems but don't fix them. Guardrails protect the model but not the tools. Prompt rules are suggestions, not enforcement.

AgentWard fills this gap. It's a proxy that sits between agents and tools, evaluating every tools/call against a declarative policy — in code, at runtime, where prompt injection can't reach.

Prerequisites

AgentWard scans and enforces policies on your existing AI agent tools. You need at least one of:

• Cursor with MCP servers configured
• Claude Desktop with MCP servers configured
• VS Code with MCP servers (Copilot or extensions)
• Windsurf with MCP servers configured
• OpenClaw with skills installed

No MCP servers yet? AgentWard can also scan Python tool definitions (OpenAI, LangChain, CrewAI) in any project directory.

Quick Start

pip install agentward
agentward init

That's it. agentward init scans your tools, shows a risk summary, generates a recommended policy, and wires AgentWard into your environment. Most users don't need anything else.

If you want more control, you can run each step individually. AgentWard follows a five-step security lifecycle:

SCAN → CONFIGURE → ENFORCE → VERIFY → MONITOR

• SCAN — discover tools, classify risk, detect supply chain threats before runtime
• CONFIGURE — generate a policy tailored to what scan found
• ENFORCE — run the proxy; every tool call evaluated against policy in code
• VERIFY — fire adversarial probes through the engine, confirm policies block what they should
• MONITOR — audit trail in JSON Lines and RFC 5424 syslog for SIEM integration

1. Scan your tools

agentward scan

Auto-discovers MCP configs (Claude Desktop, Cursor, Windsurf, VS Code), Python tool definitions (OpenAI, LangChain, CrewAI), and OpenClaw skills. Outputs a permission map with risk ratings, skill chain analysis, security recommendations, developer fix guidance, and compliance-framework hints — when scan detects PHI, financial, trading, personal-data, or cardholder-data patterns, it surfaces the relevant frameworks (HIPAA / GDPR / SOX / PCI-DSS / DORA / MiFID II) and the exact agentward comply --framework <name> command to evaluate against them. A markdown report (agentward-report.md) is saved automatically.

The scanner also runs pre-install security checks on skill directories before you install them — catching threats at the supply chain stage, before they can execute code at runtime:

• Deserialization attack detection (CRITICAL) — identifies pickle.loads, yaml.load, Java deserialization, and PHP unserialize calls that can execute arbitrary code when the skill processes agent-controlled input
• YAML safety analysis — flags yaml.load without Loader= and bare yaml.unsafe_load calls
• Executable hook inspection — checks postinstall, preinstall, and lifecycle scripts for suspicious shell commands (ClawHavoc-style install-time code execution)
• Dependency analysis — detects typosquatting candidates and known-malicious package names
• .pth file scanning (--scan-site-packages) — scans Python site-packages directories for malicious .pth files that execute code at interpreter startup; see Supply Chain: .pth File Scanner

Tool-schema-level checks the scanner also runs against every MCP server it enumerates:

• REPL chain detection (HIGH) — flags servers exposing both an interpreter-launching tool (start_process with python/node/bash -i) and a stdin-injection tool (interact_with_process); injected code runs inside the REPL and bypasses shell-level pattern matching
• Persistence chain detection (CRITICAL) — flags servers combining arbitrary file write with runtime config mutation (e.g. write_file + set_config_value(defaultShell, …)), the canonical write-then-reconfigure backdoor pattern
• SSRF parameter detection (HIGH) — flags tool inputs that accept URLs (url, endpoint, isUrl-style booleans) without an allowlist constraint in the description
• Session/call-history exposure (HIGH, escalates to CRITICAL with readOnlyHint: true) — flags tools like get_recent_tool_calls that let an attacker enumerate prior tool invocations; readOnlyHint=true is also surfaced as a silent-auto-approval amplifier on any HIGH+ tool

agentward scan ./my-downloaded-skill/    # pre-install check before installing

agentward scan ~/clawd/skills/bankr/          # scan a single skill
agentward scan ~/.cursor/mcp.json             # scan specific MCP config
agentward scan ~/project/                     # scan directory
agentward scan --format html                  # shareable HTML report with security score
agentward scan --format sarif                 # SARIF output for GitHub Security tab
agentward scan --scan-site-packages           # also scan .pth files in site-packages
agentward scan --skip-site-packages           # skip .pth scanning

2. Generate a policy

agentward configure

Generates a smart-default agentward.yaml with security-aware rules based on what scan found — skill restrictions, approval gates, and chaining rules tailored to your setup.

# agentward.yaml (generated)
version: "1.0"
default_action: allow               # or "block" for zero-trust (allowlist mode)
skills:
  filesystem:
    read_file: { action: allow }
    write_file: { action: approve }   # requires human approval
  shell-executor:
    run_command: { action: block }    # blocked entirely
require_approval:
  - send_email                        # always requires approval
  - delete_file
  - tool: shell_exec                  # conditional: only sudo commands
    when:
      command:
        contains: sudo

# Declarative per-argument constraints (capability scoping)
capabilities:
  write_file:
    path:
      must_start_with: ["/tmp/", "/workspace/"]
      must_not_contain: [".."]
      blocklist: ["/etc/shadow", "/etc/passwd"]
  http_request:
    url:
      allowed_domains: ["api.internal.example.com"]
      allowed_schemes: ["https"]
    method:
      one_of: ["GET", "POST"]

3. Wire it in

# MCP servers (Claude Desktop, Cursor, etc.)
agentward setup --policy agentward.yaml

# Or for OpenClaw gateway
agentward setup --gateway openclaw

Rewrites your MCP configs so every tool call routes through the AgentWard proxy. For OpenClaw, swaps the gateway port so AgentWard sits as an HTTP reverse proxy.

4. Enforce at runtime

# MCP stdio proxy
agentward inspect --policy agentward.yaml -- npx @modelcontextprotocol/server-filesystem /tmp

# HTTP gateway proxy (start proxy first, then restart OpenClaw)
agentward inspect --gateway openclaw --policy agentward.yaml
# In another terminal:
openclaw gateway restart

# Dry-run mode — observe what would be blocked without enforcing
agentward inspect --gateway openclaw --policy agentward.yaml --dry-run