agnostic-security

AgnosticSecurity

The firewall for AI coding agents. Prevents secrets, credentials, and PII from leaking through Copilot, Claude Code, Cursor, and LangChain — before the data ever leaves your machine.

---

Your AI coding assistant has read access to your entire codebase — .env files, API keys, SSH keys, customer PII. There are zero guardrails. AgnosticSecurity is that guardrail.

---

Quick Start

Prerequisites: Python 3.11+, Docker (optional), Ollama (optional)

# Option 1: Install from PyPI
pip install securityagent-core
as-init   # auto-detects your AI tools and configures protections

# Option 2: From source
git clone https://github.com/secure-mind-live/AgnosticSecurity.git
cd AgnosticSecurity
pip install -e .
as-init

# Option 3: Docker (full stack — gateway + breach engine + LLM proxy)
docker compose up

# Option 4: Just the VS Code extension
code --install-extension vscode-extension/agnostic-security-*.vsix

That's it. Your .env files, credentials, and PII are now protected from every AI tool in your environment.

---

What It Does

Your code editor (VS Code / Cursor / Windsurf)
  │
  │  ── AI tries to read .env ──────────── BLOCKED (file gate)
  │  ── AI autocompletes a secret ──────── BLOCKED (context boundary)
  │  ── @workspace indexes credentials ─── BLOCKED (search.exclude)
  │  ── Prompt contains SSN ────────────── BLOCKED (prompt guard)
  │  ── Agent runs `curl -d @.env` ─────── BLOCKED (exec guard)
  │  ── LLM response leaks PII ────────── BLOCKED (output scan)
  │  ── Memory stores "password is X" ──── BLOCKED (memory guard)
  │  ── Tool call smuggles data out ────── BLOCKED (tool call guard)
  │  ── AI bulk-edits .env (15+ lines) ── REVERTED (AI-vs-human detection)
  │
  └── Everything else ──────────────────── Works normally

Key insight: We don't block AI from editing files (that's a losing game). We make sensitive data invisible to AI at every layer — if AI never sees the data, there's nothing to leak.

---

Protection Layers

---

Works With Everything

Any LLM provider works — OpenAI, Anthropic, Google, Azure, local Ollama. Security shouldn't depend on your model choice.

---

Installation Options

---

Architecture

Developer using Copilot / Claude Code / Cursor / LangChain
  │
  ├── VS Code Extension ──────── Context boundary — data never enters AI context
  │                                ├── .copilotignore / .cursorignore / .aiignore
  │                                ├── search.exclude (blocks @workspace)
  │                                ├── LM API interceptor (scans all prompts)
  │                                └── @security / @guard chat participants
  │
  ├── Chrome Extension ──────── DLP for web AI tools (ChatGPT, Claude, Gemini, Grok, Perplexity, DeepSeek, Meta AI, HuggingChat)
  │
  ├── Claude Code Hooks ──────── PreToolUse (Read/Edit/Write/Bash) + UserPromptSubmit
  │                                └── 4-layer: PII regex → intent → Pydantic → LLM
  │
  ├── Ingress Guard ──────────── 7-layer external agent defense
  │                                └── Fingerprint → behavior → risk → reputation → policy → headers → DLP controls
  │
  ├── API Gateway + LLM Proxy ── Input/output security pipelines
  │                                ├── PII redaction + injection detection
  │                                ├── Base64 decode + credential detection + multi-step exfil blocking
  │                                ├── DLP-to-breach engine bridge (auto-escalation)
  │                                ├── Smart Router (5 strategies, 14 models, 4 providers)
  │                                ├── Unified single-port dashboard (/dashboard + /unified + /console)
  │                                └── Cost tracking + block rules
  │
  ├── Effect-Layer Defenses ──── Taint tracking, egress allowlist, lethal trifecta,
  │                                tool call guard, code fingerprint, vuln scanner,
  │                                shadow AI detector, privacy mode, knowledge graph
  │
  ├── Red Team Harness ──────── 55 attack agents in Docker, 100% detection rate
  │
  └── Breach Compliance ──────── Rule-based classification (<1ms, no LLM)
                                   ├── 13 fintech breach types (PCI-DSS, SOX, HIPAA)
                                   ├── Immutable SHA-256 audit log
                                   ├── Agent registration (email-verified)
                                   ├── Admin Console (RBAC, policy versioning)
                                   └── Real-time dashboard

---

Compliance

All controls mapped to industry frameworks with automated scoring:

• OWASP Top 10 for LLM Applications — python3 scripts/owasp_score.py
• NIST AI Risk Management Framework — python3 scripts/nist_score.py
• MITRE ATLAS — coverage across 274-attack red-team suite + 55-agent Docker harness
• 50-check security audit — python3 scripts/audit.py

---

Testing

942 automated tests across 28 suites, plus a Docker-based red-team harness:

source .venv/bin/activate

# Core tests (run any individually)
python3 scripts/smoke_test.py                 # 31 — file gate + content DLP
python3 scripts/test_red_team.py              # 52 — adversarial red-team
python3 scripts/test_pii_prompt_guard.py      # 18 — PII evasion
python3 scripts/test_outbound_guards.py       # 42 — obfuscation + egress
python3 scripts/test_ingress_guard.py         # 54 — ingress guard

# Red team Docker harness (55 agents, 10 OWASP categories)
docker compose -f docker-compose.redteam.yml up --build -d
docker exec agsec-attacker python3 /agents/run_all.py

# Continuous red-teaming with HTML reports
python3 scripts/continuous_red_team.py
python3 scripts/red_team_report.py

---

Privacy

• Runs entirely on your machine — no telemetry, no analytics, no cloud dependency
• Pluggable LLM backend — use local Ollama (air-gapped), Anthropic, or OpenAI for optional semantic analysis
• Privacy mode — one-command killswitch for cloud LLM access (EA_PRIVACY_MODE=full_privacy), enterprise policies with org-wide/per-team overrides and scheduled mode changes
• Audit logs stored locally — SHA-256 checksummed, tamper-detected, JSONL archived

---

GitHub Action

# .github/workflows/security.yml
name: AgnosticSecurity Scan
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: kaushikdharamshi/AgnosticSecurity/.github/actions/security-scan@main
        with:
          severity-threshold: HIGH
          fail-on-findings: true
          scan-dlp: true
          scan-vulns: true

---

25 Components

---

Competitive Positioning

                    Pre-commit  In-IDE   AI Runtime   Post-incident  CI/CD    Browser   Inbound
                    (hooks)     (live)   (agent layer) (detection)   (Action) (web LLMs) (API defense)
GitGuardian         ========    ....     ........     ========       ======== ......    ........
Snyk                ........    ======== ........     ========       ======== ......    ........
Semgrep             ========    ======== ........     ........       ======== ......    ........
Prompt Armor        ........    ....     ========     ........       ........ ......    ........
Lakera Guard        ........    ....     ========     ........       ........ ......    ........
AgnosticSecurity    ========    ======== ========     ========       ======== ========  ========
                                         ^^^^^^^^                             ^^^^^^^^  ^^^^^^^^
                                         SHARED                               ONLY US   ONLY US

---

Configuration Reference

Environment variables

DLP Engine

Variable	Default	Description
EA_LLM_PROVIDER	ollama	LLM provider for semantic analysis (ollama, anthropic, openai)
EA_PRIVACY_MODE	balanced	Privacy mode (full_privacy, balanced, permissive)
EA_ALLOWED_DOMAINS	—	Comma-separated egress allowlist
EA_LETHAL_TRIFECTA	1	Enable lethal trifecta detector
EA_INGRESS_GUARD	1	Enable ingress guard
EA_CODE_GUARD_ENABLED	1	Enable code fingerprint guard
EA_SHADOW_AI_ENABLED	1	Enable shadow AI detector
EA_KNOWLEDGE_GRAPH_ENABLED	1	Enable knowledge graph
EA_DLP_CONFIDENCE_THRESHOLD	0.5	Minimum confidence to flag PII

Gateway

Variable	Default	Description
GATEWAY_API_KEYS	sk-gateway-changeme	Comma-separated client API keys
OPENAI_API_KEY	—	OpenAI API key
ANTHROPIC_API_KEY	—	Anthropic API key
RATE_LIMIT_RPM	60	Max requests per minute per key

VS Code Extension

Setting	Default	Description
agnosticsecurity.enabled	true	Master toggle
agnosticsecurity.autoDisableCopilot	true	Disable Copilot for sensitive files
agnosticsecurity.sensitiveFileGlobs	[defaults]	Custom sensitive file patterns

---

Key Documents