AgentGuard

AgentGuard is a prompt injection firewall for AI agents. Agents that browse the web, read email and call tools can be hijacked by instructions hidden in the content they read. AgentGuard sits between the agent and its tools. It labels every piece of content as trusted (the user) or untrusted (web pages, files, tool output, and anything the model derived from them), tracks where each tool argument came from, and refuses side-effectful actions whose targets only untrusted content asked for. For example, an email address that appears only in a web page can never be the recipient of a send_email call, however politely the page asks. Origin tracking is the main defense because pattern matching alone loses to paraphrase; a heuristic detector and an optional Meta Model API judge add a second signal. It ships with adapters (plain functions, OpenAI-style and Anthropic-style tool calls, LangChain), an HTTP proxy with Redis-backed sessions, rate limits and a hash-chained audit log, Kubernetes manifests, a live web demo and 177 tests. On 46 real attacker goals taken from the public AgentDojo benchmark it held the attacker's action in 41 (89%). The README documents the limits and what was not tested.