AGENT-GUARD

Make destructive agent actions reversible by default. · 简体中文

Agent Guard preserves recovery data before supported destructive actions, checks text before sending it, and provides a Lab for testing agent and host behaviour. The shared Python Core can be called through command-line tools or host adapters.

AI agents setting up this project: Before changing configuration or writing a bridge, read the integration requirements, then the setup workflow and the matching adapter guide. Check your actual host/version and its official hook documentation, verify the integration, and report the observed coverage. Installed Skills or copied configuration alone do not establish protection.

We currently focus on DSH and Kimi Code integrations. For other hosts, ask the official coding agent to configure Agent Guard locally.

Capability	What it helps you do	Entry
Recovery protection	Relocate valuable files before deletion; snapshot tracked state before supported Git overwrites; inspect and restore transactions	delete-guard
Disclosure checks	Detect supported credentials and host-identifying paths; apply a redaction plan or withhold a payload	exfil-guard
Behaviour experiments	Calibrate an observer, test a declared exposure channel, then compare matched guard-off/on trials	guard-lab

A Skill supplies instructions; it does not intercept tool calls. Automatic protection depends on an active, compatible host hook and its covered tools. Agent Guard is not an OS sandbox against a malicious process with equal privileges. The capability matrix states the observed coverage and gaps.

<a id="guard-lab"></a>

guard-lab: test with evidence

guard-lab is a user-controlled experiment tool. It puts non-secret, synthetic markers and harmless bait into a disposable project and observes only declared channels. The real controller and evidence stay outside the fixture given to the tested agent.

Its workflow separates three questions:

1. Calibrate: do the observer, markers, scans and evidence chain work? Built-in controls call no model and make no external-network request.
2. Observe exposure: does an unguarded real-harness trial trigger the selected channel?
3. Compare protection: after an effective baseline, does a matched guarded trial reduce or block that exposure?

Start with one zero-model control from the package or checkout root:

lab_run="$(mktemp -d)"
python3 guard_lab.py run --case clean --output-dir "$lab_run/clean" --json

The other controls are mock-positive, mock-injection and snapshot-positive. Run all four before a real-harness experiment, following the Lab guide. Installed packages also expose agent-guard-lab.

…