PkgFoundry
Catalog PyPI
Back to packageRELEASE DETAILS

1.2.1

PyPI

agent-action-guard

Runtime classifier for screening AI agent actions as safe, harmful, or unethical.

aiai-agentsai-safetyartificial-intelligencellmllmsmcptool-calling
Published23 Sept 2026
Direct dependencies23
Transitive dependenciesNot calculated

README

Version 1.2.1 documentation

Agent Action Guard

Agent Action Guard

Framework to block harmful AI agent actions before they cause harm — lightweight, real-time, easy-to-use.

PyPI Website Medium npm

PyPI Downloads AI LLMs Python License: CC BY 4.0

🚀 Quick Start

Python package support: Python 3.8 through Python 3.14.

pip install agent-action-guard
# or
uv add agent-action-guard

For embedding backend options and configuration details—including zero-config ONNX embeddings, custom local ONNX models, OpenAI-compatible embedding APIs, environment variables, and backend precedence—read USAGE.md. The installed packages also provide aag-classify for direct JSON, JSON arrays, and JSONL batch classification.

Want to run the evaluation benchmark too?

pip install "agent-action-guard[harmactionseval]"
# or
uv add "agent-action-guard[harmactionseval]"

python -m agent_action_guard.harmactionseval

JavaScript Runtime

The repository also ships an npm package in typescript/package.json for screening agent actions in Node.js.

npm install agent-action-guard

If you use pnpm, the equivalent commands are:

pnpm install agent-action-guard

❓ Why Action Guard?

HarmActionsEval benchmark proved that AI agents with harmful tools will use them — even today's most capable LLMs. 80% of the LLMs tested executed actions at the first attempt for over 95% of the harmful prompts.

ModelSafeActions@1
Claude Haiku 4.50.00%
Phi 4 Mini Instruct0.00%
Granite 4-H-Tiny0.00%
GPT-5.4 Mini0.71%
Gemini 3.1 Flash Lite0.71%
Grok 4.20 Non Reasoning2.13%
Ministral 3 (3B)2.13%
Claude Sonnet 4.62.84%
Phi 4 Mini Reasoning2.84%
GPT-5.312.77%
Qwen3.5-397b-a17b23.40%
Average4.54%

These models often still respond "Sorry, I can't help with that" while executing the harmful action anyway.

Action Guard sits between the agent and its tools, blocking unsafe calls before they run — no human in the loop required.

Agent Action Guard vs. Luna and Laya

Laya is a general-purpose local model that can also be used as an action-safety classifier similar to Agent Action Guard. The repository comparison benchmark evaluates Agent Action Guard, gpt-5.6-luna, and Laya on the same HarmActions rows. Local classifiers use CPU execution, and warm-up/model-loading time is excluded from the reported per-action latency.

python scripts/compare_laya_harmactions.py
ModelHarmActionsAccuracyPrecisionRecallF1ms/action
Agent Action Guard97.87%97.87%100.00%97.87%98.92%19.66
gpt-5.6-luna90.07%90.07%100.00%90.07%94.78%3381.72
Laya51.06%51.06%100.00%51.06%67.61%815.86

The benchmark uses the same HarmActions rows for all classifiers; CPU execution is forced for the local systems to make the latency comparison more consistent.

Iceberg

⚙️ How It Works

  1. Agent proposes a tool call
  2. Action Guard classifies it using a lightweight neural network trained on the HarmActions dataset
  3. Harmful calls are blocked; safe calls proceed normally
Workflow Demo

🆕 Contributions:

  • 📊 HarmActions — safety-labeled agent action dataset with manipulated prompts
  • 📏 HarmActionsEval — benchmark with the SafeActions@k metric
  • 🧠 Action Guard — real-time neural classifier optimized for agent loops
  • 🏋️ Trained on HarmActions
  • ✅ Classifies every tool call before execution
  • 🚫 Blocks harmful and unethical actions automatically
  • ⚡ Lightweight for real-time use

💬 Enjoyed it? Share your opinion.

Share a quick note in Discussions — it directly shapes the project's direction and helps the AI safety community. 🙌 Waiting with excitement for feedback and discussions on how this helps you or the AI community.

⭐ Star the repo if Action Guard is useful to you — it really does help!

📝 Citation

@article{202510.1415,
  title   = {{Agent Action Guard: Classifying AI Agent Actions to Ensure Safety and Reliability}},
  year    = 2025,
  month   = {October},
  publisher = {Preprints},
  author  = {Praneeth Vadlapati},
  doi     = {10.20944/preprints202510.1415.v2},
  url     = {https://www.preprints.org/manuscript/202510.1415},
  journal = {Preprints}
}

📄 License

Licensed under CC BY 4.0. If you prefer not to provide attribution, send a brief acknowledgment to praneeth.vad@gmail.com with the details of your usage and the potential impact on your project.

Project banner

Pro-GenAI
Projects for Next-Gen AI

Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Declared dependencies 36

Native requirements
23 direct targetsNot calculated transitive count
Package / targetRequirementRelationship
numpy
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
numpy>=1.21.6runtime
onnxruntime
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
onnxruntime<2.0.0,>=1.14.0runtime
openai
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
openai<4.0.0,>=1.0.0runtime
tokenizers
Environment
{
  "extras": "",
  "marker": "python_version < \"3.13\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
tokenizers<1.0.0,>=0.13.3; python_version < "3.13"runtime
tokenizers
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.13\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
tokenizers<1.0.0,>=0.21.0; python_version >= "3.13"runtime
python-dotenv
Environment
{
  "extras": "",
  "marker": "extra == \"harmactionseval\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
python-dotenv<2.0.0,>=0.21.0; extra == "harmactionseval"runtime
requests
Environment
{
  "extras": "",
  "marker": "extra == \"harmactionseval\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
requests<3.0.0,>=2.28.0; extra == "harmactionseval"runtime
rich
Environment
{
  "extras": "",
  "marker": "extra == \"harmactionseval\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
rich<15.0.0,>=12.0.0; extra == "harmactionseval"runtime
fastapi
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
fastapi; extra == "all"runtime
fastembed
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
fastembed; extra == "all"runtime
psutil
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
psutil; extra == "all"runtime
pydantic
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
pydantic; extra == "all"runtime
python-dotenv
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
python-dotenv<2.0.0,>=0.21.0; extra == "all"runtime
pytz
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
pytz; extra == "all"runtime
requests
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
requests<3.0.0,>=2.28.0; extra == "all"runtime
rich
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
rich<15.0.0,>=12.0.0; extra == "all"runtime
uvicorn
Environment
{
  "extras": "standard",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
uvicorn[standard]; extra == "all"runtime
torch
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
torch; extra == "dev"runtime
onnx
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
onnx<2.0.0,>=1.14.0; extra == "dev"runtime
uv
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
uv; extra == "dev"runtime
ruff
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
ruff; extra == "dev"runtime
black
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
black; extra == "dev"runtime
isort
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
isort; extra == "dev"runtime
flake8
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
flake8; extra == "dev"runtime
pylint
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
pylint; extra == "dev"runtime
mypy
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
mypy; extra == "dev"runtime
python-dotenv
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
python-dotenv<2.0.0,>=0.21.0; extra == "dev"runtime
requests
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
requests<3.0.0,>=2.28.0; extra == "dev"runtime
rich
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
rich<15.0.0,>=12.0.0; extra == "dev"runtime
scikit-learn
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
scikit-learn; extra == "dev"runtime
fastembed
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
fastembed; extra == "dev"runtime
psutil
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
psutil; extra == "dev"runtime
pytz
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
pytz; extra == "dev"runtime
fastapi
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
fastapi; extra == "dev"runtime
uvicorn
Environment
{
  "extras": "standard",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
uvicorn[standard]; extra == "dev"runtime
pydantic
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.8",
  "evaluation": "NOT_EVALUATED"
}
pydantic; extra == "dev"runtime

Distribution files

2 collected
agent_action_guard-1.2.1-py3-none-any.whl

bdist_wheel · 90.16 KB · Python py3

Source file
agent_action_guard-1.2.1.tar.gz

sdist · 95.08 KB · Python source

Source file

Repository

PENDING
pro-genai/agent-action-guard

Shared repository data · GitHub

License detected in repository
Not collected

Metadata history

Meaningful changes
Current collected state Current

Observed since 20 Oct, 21:27 UTC

No superseded metadata states collected. Unchanged observations do not create new revisions.

Record identity

package_version:be58db7cb32f248bcc3ae3758ab35724dbe07ef3801c2e5ace1f4ed0d62bc42c

Other collected versions

View all collected versions →