agent-security
https://github.com/solongate/agent-security
Go
Local-first, open-source security gateway for AI coding agents. Enforce tool-call policies, detect secrets, and audit actions on-device.
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
Go not yet supported1 Subscribers
Add a CodeTriage badge to agent-security
Help out
- Issues
- tokens: opencode and codex readers skip the sanitization and dedup every other source gets
- auditcmd: audit-logs substring match, filenames shape, and pre-scan truncation all let secrets bypass DLP
- auditcmd: rate-limit burst tracking has no locking, letting concurrent calls race and undercount
- crypto: VerifyDocument's error and legacy-unsigned handling both let forged policy.json through
- policy: FallbackEvaluate disagrees with the OPA engine on enabled defaults, AND/OR semantics, and rootDirectory
- policy: extract_commands.go misses quoted URLs, newline-separated statements, and the code field
- policy: rootDirectory confinement uses unanchored prefix matching on uncleaned paths
- hooks: go_bin() picks the cached Go toolchain with a lexicographic, not version-aware, sort
- client: readStore trusts an unsigned policy.json unconditionally
- client: validateSandboxDir never resolves symlinks before the home/root guard
- Docs
- Go not yet supported