AgentWard is an open-source permission control plane for AI agents, positioned as a security proxy layer between agents and tools. Its core philosophy is: telling an agent in natural language "don't touch the stove" is a bypassable guardrail, whereas AgentWard installs a physical lock on the stove—code-level enforcement that prompt injection cannot override. It sits between AI agents and tools such as MCP servers, HTTP gateways, and function calls, enforcing least-privilege policies, inspecting data flows at runtime, and generating compliance audit trails. Policies are enforced in code outside the LLM context window, invisible to the model, impossible to override, and impossible to be induced to ignore.
The main capabilities cover a five-step security lifecycle: SCAN discovers tools before runtime, classifies risk, and detects supply chain threats; CONFIGURE generates tailored policies based on scan results; ENFORCE runs the agent, with every tool call evaluated in code according to policy; VERIFY confirms through adversarial probes that policies block what should be blocked; MONITOR outputs audit trails in JSON Lines and RFC 5424 syslog, facilitating SIEM integration.
The scanner automatically discovers MCP configurations (Claude Desktop, Cursor, Windsurf, VS Code), Python tool definitions (OpenAI, LangChain, CrewAI), and OpenClaw skills, outputting a permission graph with risk ratings, skill chain analysis, security recommendations, and compliance framework prompts. When patterns of PHI, financial, trading, personal data, or cardholder data are detected, it prompts for frameworks such as HIPAA / GDPR / SOX / PCI-DSS / DORA / MiFID II and the corresponding agentward comply --framework <name> command. Before installation, it also inspects skill directories, catching deserialization attacks, unsafe YAML loading, suspicious install hooks, dependency typosquatting, and malicious .pth files. Tool architecture-layer checks include REPL chains, persistence chains, SSRF parameters, session/call history exposure, and more.
On the runtime side, AgentWard acts as a transparent proxy intercepting every tool call, allowing, blocking, or flagging for approval according to policy, and recording a complete audit trail. Policies support capability scope refinement, turning resource-level switches into parameter-level constraints, covering string, network, numeric, boolean, array, and other constraints, using AND logic, failing closed by default, and using only the Python standardlibrary evaluation.
In addition, AgentWard provides remote approvals: when used with OpenClaw and Telegram, tool calls with action: approve can be sent to a phone as messages with Allow Once, Allow Session, and Deny buttons, with the local macOS dialog and Telegram racing in parallel. A built-in PII detection and redaction engine supports 15 categories of PII, processes entirely locally, and can be used as a Python module or a zero-dependency script. The LLM-as-Judge layer performs a secondary model evaluation of calls that pass the policy engine, detecting prompt injection, scope creep, and semantic bypass, and the judge can only escalate decisions, not override an explicit BLOCK. Session-level evasion detection scores rolling call windows through five pattern detectors, identifying stealthy attacks spanning multiple steps. Policy regression testing agentward probe discovers policy drift through an adversarial call library.
Usage starts with agentward init: scan tools, display a risk summary, generate recommended policies, and integrate with the environment. Each stage can also be run step by step. Applicable scenarios include Cursor, Claude Desktop, VS Code, and Windsurf users who use MCP servers, as well as users who install OpenClaw skills; when there is no MCP server, Python tool definitions can also be scanned. In terms of limitations, at least one of the above environments must be configured; in the OpenClaw scenario, the agent must be running before OpenClaw restarts; LLM-as-Judge requires optional dependencies to be installed, and startup will fail if they are missing; some framework and command-line details are not fully expanded in the materials.
