AgentSafe CLI
AgentSafe is an agent API gateway that links an executed operation to a single-use grant and a record in its audit trail.
- 671 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The gateway forwards authorized API requests that can change data or make payments; connected services need appropriate permissions and limits.
- Decisions and evidence can reveal payment or data-mutation details.
Install
Manual install
brew tap decionis/agent-safe https://github.com/decionis/agent-safe-pipeline && brew trust decionis/agent-safe && brew install agentsafeInstalls AgentSafe CLI through Homebrew. Run `agentsafe test` against the demo service before connecting your own API.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The gateway forwards authorized API requests that can change data or make payments; connected services need appropriate permissions and limits.
- Decisions and evidence can reveal payment or data-mutation details.
This is third-party code. Review the repository files before installing.
What it does
AgentSafe is a CLI-managed gateway that receives an HTTP request instead of the target service and captures the intended action. A separate Decionis control plane makes the decision. The gateway forwards an authorized request, holds one needing approval or refuses it. An allowed operation is tied to a single-use grant and an evidence record. Shadow mode lets operators observe decisions before blocking traffic. Demo rules and a local test HTTP service that records incoming requests support the first test.
Who it is for. Integration developers introducing authorization before a specific agent action reaches a service API.
Good fit when
- An authorization gateway is placed before a payment API or data write.
- Policy decisions are compared with traffic before blocking is enabled.
- An action above a configured threshold waits for a person.
- An audit relates an operation’s authorization to execution records.
Not a fit when
- The agent can freely reach the upstream service around the gateway.
- You need an embedded production policy engine independent of Decionis.
- You expect shadow mode to stop a harmful request.
Example request
Show AgentSafe with the local test HTTP service, then plan observation of a test API without changing the production system.Limitations
Without Decionis, the gateway uses demo rules; the production decision service is not included in this repository. Deny the agent direct access to the upstream API or it can send requests without a gateway check. During a decision-service outage, behavior depends on configuration: blocking requests and passing them without a decision have different consequences, so choose beforehand. Evidence records action parameters and can expose payment or personal data; restrict access to audit files.
How to disable. Stop the gateway after an agreed traffic-routing change. Inspect held actions and retained evidence; completed requests are not automatically rolled back.
FAQ
Who decides whether an action is allowed?
Decionis. The gateway captures intent and enforces the received decision; the control plane defines policy.
What does `agentsafe test` check?
The same synthetic actions directly, through shadow mode and through enforcement. Local testing does not need your live data.
How do I inspect environment readiness?
Run `agentsafe doctor` for conditions that prevent boundary enforcement.
Can the evidence chain be verified?
Yes. Use `agentsafe verify chain` with the saved file path.
Does the repository contain the entire production service?
No. Gateway and contract sources use Apache-2.0, while Decionis operates separate decision and presence services.
Discussion
No questions or reviews yet.
Related
CLI toolsA policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
A local security gateway for Claude Code and Codex: checks tool calls against a policy, catches secrets and keeps an audit trail
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
A CLI creates and checks signed agent-action receipts, exports audit records and verifies prepared bundles locally.
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| AgentSafe (this card) | no | 671 | |
| HOL Guard | yes | 1,072 | checks agent actions through local hooks, including shell commands and package installs |
| Asqav CLI | no | 429 | A CLI creates and checks signed agent-action receipts, exports audit records and verifies prepared bundles locally. |
README in short
Deployment options cover a host, Docker and Kubernetes. The reference separates gateway management, evidence verification and trusted execution.