DESIGN & THREAT MODEL
Why I put a proxy between my AI agent and my server
The placement of the enforcement point, three failure modes, and the limits of the protocol boundary.
Project · AI Security
AgentGuard
A least-privilege proxy for AI agent tool calls.
AgentGuard sits between an AI agent and an MCP server. It inspects calls before execution and results before they return to the agent, without requiring changes to either endpoint.
Security layers
Call policy
Deny rules for file paths and shell commands, plus host allowlists for network access.
Injection blocking
Scans tool output for instruction-shaped content and blocks the entire result on a match.
Secret redaction
Masks known secret formats before allowed tool output reaches an agent context.
Auditable decisions
Writes policy decisions to a hash-chained audit log so later edits are detectable.
AgentGuard is a protocol-level control. It does not sandbox the MCP server process, does not claim to catch every prompt-injection phrasing, and makes its threat-model boundaries explicit.
Engineering notes
All writingIMPLEMENTATION & TRADEOFFS
Rule-based prompt-injection detection: what it catches, what it costs
Whole-message blocking, deterministic rules, and a false negative found by the shipped-policy test suite.