agentarmor-core

🛡️ AgentArmor

Comprehensive open-source security framework for agentic AI applications.

AgentArmor provides 8-layer defense-in-depth security for AI agents, covering every point in the data flow where data is at rest, in transit, or in use. Built to address the OWASP Top 10 for Agentic Applications (2026).

---

🚀 What's New in v0.5.0 — Hardened Security Layers

This is a major security release that upgrades four layers from basic implementations to production-grade, adversarially-tested enforcement engines:

• 🧠 L3: Hardened Context Assembly — GoalLock anchor prevents goal hijacking mid-conversation. CanaryVault injects multiple unique canary tokens per session. Tiered context assembly strips template injection before it reaches the LLM. Validated against 48 adversarial test cases.

• 🎯 L4: Hardened Planning & Reasoning — ActionChainTracker detects multi-step attack chains (reconnaissance → escalation → exfiltration). Semantic risk scoring evaluates action intent, not just verbs. Validated against 40 adversarial test cases.

• 🔒 L5: Hardened Execution Control — Five enforcement domains: Network Policy (DNS rebinding + SSRF protection), Rate Limiting (token bucket + circuit breaker), Resource Budget (timeout + size limits), Output Sanitizer (UTF-8 + binary strip), and Side-Effect Auditor (immutable execution records). Validated against 39 adversarial test cases.

• 🛡️ L6: Hardened Output Security — Five-scanner pipeline: Credential Scanner (13+ patterns, zero false positives), PII Scanner (confidence-gated Presidio), Harmful Content Detector (jailbreak + system prompt leak detection), Semantic Exfiltration Detector (cross-response tracking), and Schema Validation. Supports both streaming and non-streaming responses. Validated against 12 adversarial test cases.

• 🔐 L2: Encrypted Storage — All data stored in Studio's SQLite database is now AES-256-GCM encrypted with HMAC-based MAC signatures for tamper detection.

127+ adversarial test cases validate the hardened layers end-to-end.

---

Why AgentArmor?

Every existing security tool is a point solution — output validators, prompt injection scanners, or policy engines in isolation. AgentArmor is the first unified framework that secures the entire agentic architecture end-to-end.

The 8 Security Layers

Quick Start

Install

# Using uv (recommended)
uv add agentarmor-core

# With MCP server support (for Claude Code, OpenClaw, etc.)
uv add "agentarmor-core[mcp]"

# With PII detection
uv add "agentarmor-core[pii]"

# With all optional features
uv add "agentarmor-core[all]"

# Available extras: proxy, pii, otel, mcp, oauth, all, dev

# For development
git clone https://github.com/Agastya910/agentarmor.git
cd agentarmor
uv sync --all-extras --dev

Basic Usage

import asyncio
from agentarmor import AgentArmor, ArmorConfig

async def main():
    armor = AgentArmor()

    # Register your agent
    identity, token = armor.l8_identity.register_agent(
        agent_id="my-agent",
        permissions={"read.*", "search.*"},
    )

    # Intercept tool calls
    result = await armor.intercept(
        action="read.file",
        params={"path": "/data/notes.txt"},
        agent_id="my-agent",
        input_data="Read the file please",
    )

    print(f"Safe: {result.is_safe}")
    print(f"Verdict: {result.final_verdict.value}")

asyncio.run(main())

Use as Decorator

@armor.shield(action="database.query")
async def query_database(sql: str) -> dict:
    return db.execute(sql)

Proxy Server Mode

agentarmor serve --config agentarmor.yaml --port 8400

curl -X POST http://localhost:8400/v1/intercept \
  -H "Content-Type: application/json" \
  -d '{"action": "read.file", "agent_id": "my-agent", "input_data": "Hello"}'

---

Hardened Layer Examples

L3 Context Hardening — GoalLock

AgentArmor's L3 layer prevents goal hijacking by anchoring the agent's purpose at the start of every conversation. Template injection attempts are stripped before reaching the LLM.

from agentarmor.layers.context.assembler import L3ContextLayer

l3 = L3ContextLayer(
    agent_id="my-agent",
    agent_config={
        "system_prompt": "You are a helpful assistant.",
        "tools": ["web_search", "file_read"],
    },
)

# Build a hardened system prompt with canary tokens and GoalLock
hardened_prompt = l3.build_secure_system_prompt(
    base_system_prompt="You are a helpful assistant.",
    conversation_id="session-123",
)

# After LLM responds, check for canary leaks and goal drift
safe_response, events = await l3.check_output(
    conversation_id="session-123",
    response=llm_response,
    tool_calls=[],
    turn_number=1,
    user_message=user_input,
)

L5 Execution Hardening — Network Policy

The L5 layer enforces DNS rebinding protection, protocol restrictions, and domain allowlists/blocklists on every outbound request.

from agentarmor.layers.execution.l5_execution import L5ExecutionLayer, NetworkPolicy

l5 = L5ExecutionLayer(
    agent_id="my-agent",
    network_policy=NetworkPolicy(
        allow_http=False,  # HTTPS only
        domain_allowlist=["api.github.com", "*.openai.com"],
        domain_blocklist=["metadata.google.internal", "*.local"],
        dns_rebinding_protection=True,
        max_outbound_payload_bytes=50_000,
    ),
)

# Execute a tool with full L5 enforcement
result, event = await l5.execute(
    tool_name="web_search",
    tool_args={"query": "latest AI news"},
    tool_func=my_search_function,
    session_id="session-123",
    outbound_url="https://api.tavily.com/search",
)

L6 Output Hardening — 5-Scanner Pipeline

The L6 layer scans every output for credentials, PII, harmful content, and semantic exfiltration patterns.

from agentarmor.layers.output.filter import L6OutputLayer

l6 = L6OutputLayer(
    agent_id="my-agent",
    enable_pii_scan=True,
    enable_harmful_scan=True,
)

# Scan a response
safe_text, result = l6.process(llm_response, session_id="session-123")

if result["verdict"] == "block":
    print("Response contained critical security violation!")
else:
    print(f"Cleaned: {result['findings_count']} findings redacted")

---

Integrations

MCP Server — Zero-Code Security for Any Agent (v0.4.0)

AgentArmor runs as a native MCP server that any MCP-compatible coding agent can call directly — no Python code changes needed in your project.

Setup for Claude Code — add to ~/.claude/claude_desktop_config.json:

{
  "mcpServers": {
    "agentarmor": {
      "command": "uv",
      "args": ["run", "agentarmor-mcp"],
      "cwd": "/path/to/your/project"
    }
  }
}

Available MCP Tools:

📖 Full setup guide: docs/claude_code_setup.md

TLS + OAuth 2.1 Verification (v0.3.0)

from agentarmor import MCPGuard

guard = MCPGuard()
result = guard.full_security_scan("https://api.example.com/mcp")
print(result["overall_risk"])  # "low" / "medium" / "high" / "critical"

OpenClaw Identity Guard (v0.2.0)

from agentarmor import OpenClawGuard
guard = OpenClawGuard(identity_dir="~/.openclaw")
enc_report = guard.encrypt_identity_files()  # AES-256-GCM + BLAKE3

LangChain / OpenAI

# LangChain
from agentarmor.integrations.langchain import AgentArmorCallback
callback = AgentArmorCallback(armor=armor)

# OpenAI
from agentarmor.integrations.openai import secure_openai_client
client = secure_openai_client(OpenAI(), armor=armor)

📖 Full integration guide: docs/integrations.md

---

CLI Commands

Custom Security Policies

# policies/my_agent.yaml
version: "1.0"
name: "database_agent"
agent_type: "database"
risk_level: "high"

global_denied_actions:
  - "database.drop"
  - "database.truncate"

require_human_approval_for:
  - "database.delete"

rules:
  - name: "limit_transfer_amount"
    action_pattern: "transfer.*"
    conditions:
      - field: "params.amount"
        operator: ">"
        value: "1000"
    verdict: "escalate"
    priority: 100

Architecture

                            MCP Agents (Claude Code, OpenClaw, Cursor, etc.)
                                       │
                                  stdio │ (agentarmor-mcp)
                                       ▼
Agent Runtime                   ┌─────────────────┐
(LangChain /                    │  MCP Server      │
 CrewAI /                       │  6 tools         │
 OpenAI SDK /  ─── Python ────► │  (v0.4.0)        │
 MCP)                           └────────┬─────────┘
         │                               │
         └───────────────┬───────────────┘
                         ▼
              ┌─────────────────────────────┐
              │      AgentArmor Pipeline     │
              │  ┌───────────────────────┐  │
              │  │  L8: Identity & IAM   │  │
              │  ├───────────────────────┤  │
              │  │  L1: Data Ingestion   │  │
              │  ├───────────────────────┤  │
              │  │  L2: Memory/Storage   │  │
              │  ├───────────────────────┤  │
              │  │  L3: Context Assembly │  │
              │  ├───────────────────────┤  │
              │  │  L4: Plan Validation  │  │
              │  ├───────────────────────┤  │
              │  │  L5: Action Execution │  │
              │  ├───────────────────────┤  │
              │  │  L7: Inter-Agent Sec  │  │
              │  └───────────────────────┘  │
              │  L6: Output Filter (post)   │
              │  Audit Logger (cross-cut)   │
              │  Policy Engine (cross-cut)  │
              └─────────────────────────────┘
                         │
                         ▼
                External Tools / APIs / LLMs

OWASP ASI Coverage

Documentation

Contributing

See CONTRIBUTING.md for guidelines.

License

Apache 2.0. Free for commercial and open-source use.