What is hiding in your repo?
Three ways a repo turns your own agent against you. All documented, all reproducible — and invisible in a normal PR review.
Invisible characters
Zero-width characters woven into a skill file instruct your agent to exfiltrate environment files. Invisible to humans — crystal clear to your agent.
The squatted host
A typo-squatted MCP server name slips through — your agent trusts a server you never reviewed.
The piped shell
A hook pipes remote content straight into your shell. One merged PR is enough.
Merge, calmly.
Not more process. More certainty.
See everything in seconds
One scan, every agent-facing surface: instruction files, skills, MCP configs, hooks and commands.
Proof, not gut feeling
12/12 attack fixtures caught, 47 regression tests green — every rule pinned by a test.
One gate, every harness
Claude Code, Codex, Cursor, OpenCode — the same rules, the same gate, the same peace of mind.
Deterministic — not influenceable
No LLM in the scan path. The gate cannot be talked out of a finding.
Trust, verified
A planted attack, blocked before merge. Watch the real pull request — red check, bot comment, no merge.
Live demo
Deterministic test runs against our attack fixture repo and the clean control repo. Reproducible with npm run demo.
Loading demo data…
Sharp in 60 seconds
Add the workflow
One file in your repo.
Commit
The action runs on every pull request.
First scan
Grade A–F, critical findings block the merge.
name: AgentGuard
on: pull_request
jobs:
agentguard:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: agentguard-dev/agentguard@v0
with:
exit-on: criticalStart in report mode; switch to block mode once your team is comfortable.
Start today. Cheaper than the incident it prevents.
Free
$0
- Public repos, report mode
- 12 rule classes, A–F grading
- GitHub Action + badge
- For teams: Pro ($19/repo/mo) with PR bot + merge gate — request a Pro trial
Pro — PR bot
$19 /repo/mo
- Automatic PR comments (grade + findings)
- Check-run gate: criticals block the merge
- Multi-harness: Claude Code, Codex, Cursor, OpenCode
Instant audit
$499 one-time
- Full repo scan
- Prioritized report + risk matrix (24–48 h)
- Fix list with concrete PR suggestions
RedTeam report
$499 /quarter
- 3-agent attack: attacker → defender → auditor
- Risk matrix + top-5 action list
- Monthly, measures your progress
Response within 24 h (weekdays) — first scan free.
Frequently asked
Comparison: what others do — and what AgentGuard adds
| Approach | AGENTS.md & skills | MCP | Hooks | PR gate + comment | RedTeam service |
|---|---|---|---|---|---|
| Native sandbox settings | — | — | — | — | — |
| MCP-only scanners/actions | — | — | partial | — | |
| Claude-home config auditors | partial | partial | — | — | — |
| AgentGuard |
Plus what no table shows: a verified 30-repo real-world scan as public evidence.
Built with distrust of itself
Not influenceable
Deterministic rules instead of an LLM — the tool itself cannot be prompt-injected. Details in the threat model.
Double dogfooding
AgentGuard scans itself on every own PR — and GitHub's push protection blocked a fake token in our tests during development. The rules got harder that day: changelog.
Publicly verified
Every finding in the 30-repo scan is byte-checked and publicly documented: real-world findings.