# agent-security (solongate/agent-security)
> Local-first, open-source security gateway for AI coding agents. Enforce tool-call policies, detect secrets, and audit actions on-device.
- GitHub: https://github.com/solongate/agent-security
- GitHub.Locker page: https://github.locker/solongate/agent-security
- Stars: 472
- Language: Go
- License: Apache-2.0
- Last push: 2026-11-06
---
## README (checked against GitHub 2026-11-08)
Source: https://github.com/solongate/agent-security/blob/main/README.md
|
---
**SolonGate Agent Security** is SolonGate's open source, local first security
gateway for AI coding agents. It checks tool calls against your policies before
they run, with secret detection, rate limits and a local audit trail.
This repository is the Agent Security gateway. The rest of the portfolio is at
[solongate.com](https://solongate.com).
Everything stays on the machine. The policy is a file, the audit trail is a
file, and the guard makes no network calls. No account, no telemetry.
## Install and use
Requires `git` to clone this repo. Go 1.26+ is needed too; `install.sh`
downloads the official go.dev build for you if it is not already there,
regardless of OS.
```bash
git clone https://github.com/solongate/agent-security.git
cd agent-security
./scripts/install.sh
solongate
```
Then open a new terminal. Hooks load when a session starts, so an already open
one is not guarded yet.
## What it looks like when it fires
A real Claude Code session: the agent reaches for a `.env`, the guard refuses it,
and the agent says so rather than quietly working around it.
## What it does
| Layer | What it does |
| --- | --- |
| **Policy rules** | Allow or deny by path, command, filename or URL, scoped to READ, WRITE, EXECUTE or NETWORK. |
| **DLP** | 70+ built in secret patterns plus your own, in four modes: `off`, `detect`, `redact`, `block`. |
| **Egress** | In block mode, refuses an upload whose file holds a secret, which pattern matching on the call alone cannot see. |
| **Rate limits** | A cap per minute, hour or day. |
| **The prompt** | A shim masks the outbound request body on Claude Code, which no tool call hook can reach. |
| **Tamper protection** | The guard's own state is unreachable from a tool call, and a policy in a repository cannot switch it off. |
| **Protected paths** | A path the OS itself refuses the agent, rather than a rule matched against the words in a tool call. |
| **Sandbox** | The agent's whole root is a new, minimal filesystem holding only the project; everything else is not refused, it is not there. |
## The CLI
```
solongate the TUI: policies, audit, settings
solongate policy list, create and edit the policy
solongate dlp secret detection
solongate ratelimit the rate limit
solongate policy protect lock a path, and say what the lock is worth
solongate policy protect list what is actually holding each path, read from disk
solongate sandbox list the boxes this machine has, and their ids
solongate sandbox 001 claude start the agent inside box 001
solongate sandbox --explain 001 everything that is in that box
solongate run claude start an agent with protected paths out of reach
solongate audit browse the audit trail
solongate watch live tail tool calls
solongate trace what the guard saw in this directory
solongate doctor health check
solongate repair restore the guard, hooks and settings
solongate update pull the newest version and reinstall
solongate range how far an update is allowed to move
solongate range short every commit on the branch
solongate range long tagged releases only, reliable (the default)
```
## Supported agents
## Contributors β¨
Thanks to these wonderful people. Without their help, this project would not
have made it this far.
This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome.
