Axora AgentGuard
Overview
Axora AgentGuard is the end-to-end security platform for AI agents, from the developer laptop to production fleets. It continuously discovers agents and their dependencies, validates real attack paths, and warns on, approves, or blocks agent actions at the moment they are executed.
AgentGuard pairs offensive validation, red-teaming agents before attackers do, with runtime defense, stopping malicious actions the moment they happen, and binds the two into a single loop under one control plane with enterprise-grade governance. It is built by GoPlus, the team behind the most widely used Web3 security APIs.
The Problem AgentGuard Solves
AI agents are the most over-privileged, least security-aware software in the enterprise. An agent does not only generate content. It reads files, runs commands, accesses credentials, calls internal interfaces, uses MCP tools, and increasingly signs transactions, all at the speed of automation and with no built-in judgment about safety.
Security teams are stuck on three things at once:
Can you see it?
Which agents are running, who owns them, and which models, MCP servers, RAG stores, tools, secrets, and permissions each one can reach
Has it been validated?
Whether instruction hierarchy, tool approvals, RAG grounding, and non-deterministic behavior actually resist attack
Can you control it?
Whether a dangerous action can be warned on, approved, or blocked, and whether the full history can be reconstructed afterward
Traditional scanners and penetration-testing tools were never built to probe an agent's instruction hierarchy or tool-approval flow, and there is no consistent gate to stop a risky action once it is understood. These are three breaks in the same chain.
One Loop, Four Capabilities
AgentGuard closes all three gaps as one continuous loop: discover what agents and risks exist, validate them to prove what holds, defend against real attacks at runtime, and govern the whole fleet from one control plane, feeding results back to begin again.
What makes the loop matter is that offense and defense feed each other. Validation findings tighten runtime policy. Runtime audit logs and threat intelligence become the raw material for the next validation run. Every new advisory can trigger re-validation of the whole fleet.
Discover: Know Every Agent and Its Blast Radius
AgentGuard inventories the AI estate the way an attacker would map it:
Across every source. Code repositories, cloud and model providers, and live hosts, collecting paths and references rather than sensitive content.
Framework-aware fingerprinting. Distinguishes agent frameworks such as Claude Code, Codex, OpenClaw, Hermes, OpenHands, and Goose, and separates an agent configured in a repository from one actually running on a host.
The full asset graph. Not just agents, but the models, MCP servers and tools, RAG indexes and knowledge bases, secrets, and permissions each agent can reach, with the edges connecting them. This graph is the attack surface.
Supply-chain reputation. Every skill, plugin, and MCP package is scored for trust, with content-hash tracking that catches silent malicious updates.
Validate: Prove Agents Are Safe Before Attackers Do
AgentGuard runs bounded, controlled validation against discovered assets, in an explicitly authorized and isolated environment and as dry runs. Coverage includes prompt injection and instruction-hierarchy bypass, tool-approval bypass and unsafe tool use, RAG leakage and sensitive-context exposure, MCP escalation and over-broad permission paths, secret exposure reachable from an agent, data handling and external egress, agent skill and supply-chain risk, and Web3 contract risk such as wallet draining, unlimited approvals, and reentrancy.
Results normalize into Findings with severity, evidence references, an owner, and a remediation-to-retest loop. The same detection rules and signed advisories that power runtime defense serve as the test oracle, so validation always reflects the latest known attacks. Full-scale adversarial validation is delivered through Axora Arena.
Defend: Stop Malicious Actions at Runtime
On every protected agent, AgentGuard's local-first guard evaluates actions as they happen, with no source code or secrets leaving the machine:
Automatic Guard. Hooks intercept tool calls before and after execution, blocking destructive commands, credential-file access, and webhook exfiltration, and tracking which skill initiated each action.
Deep Scan. Static analysis with detection rules across eight categories: command execution, secret access, data exfiltration, obfuscation, prompt injection, Web3 abuse, trojan and social engineering, and permission abuse.
Daily Patrol. Scheduled posture checks covering skill integrity, secret exposure, network risk, and audit-log analysis.
Every action resolves to a clear decision: allow, warn, require approval, or block, tunable from permissive to strict, with a redacted, append-only audit log of every decision.
Govern: One Control Plane for the Whole Fleet
The control plane turns thousands of local guards and validation runs into a managed program:
Central policy distribution. Author runtime policy once; every guard pulls and enforces it, with the policy version recorded on every decision.
Approval workflows. High-risk actions pause for human sign-off from a single inbox, with the decision written back to the audit trail.
Audit timelines. Per-session and fleet-wide history of every agent action, decision, and approval.
Threat intelligence network. Signed advisories for malicious skills, plugins, MCP servers, supply-chain packages, URLs, and prompt-injection payloads, delivered to every guard in real time.
Deny-first governance controls. Rules-of-engagement authorization so that no validation runs without an active, in-window customer authorization; isolated-runner attestation; blast-radius rate limits; an emergency-stop kill switch visible in the audit record; and scheduled, recurring validation of approved scope.
The Policy and Rules Engine
AgentGuard is not a black box. Enterprises author their own policy, and one policy model governs every layer, runtime defense, validation, and governance alike:
Custom runtime policy. Start from a baseline mode, permissive, balanced, or strict, then override the decision for each risk class such as destructive commands, remote code execution, data exfiltration, secret access, and deploy actions.
Organization rules and patterns. Blocked and allowed command patterns, protected paths, and network allow and deny domains that match the environment.
Organization trust registry. Pin the skills, plugins, MCP servers, and sources the organization trusts, with per-capability allowlists for execution, network, filesystem, and secrets. Everything else stays untrusted by default.
Private threat intelligence. Author advisories for organization-specific threats and distribute them to the fleet alongside the global feed.
Versioned and distributed. Policy is authored once, versioned, pushed to every guard, and recorded on every decision, so an auditor can see exactly which policy version made which call.
Because the same policy drives what the guard blocks at runtime and what validation tests, tightening a rule and proving it holds become a single action.
Architecture
Local-first by design. Guards evaluate locally and keep working offline; only redacted decisions sync upward. Source and secrets never leave the host. Local scan latency is measured in fractions of a millisecond.
Evidence-minimized and audited end-to-end. The platform records references and decisions, never raw credentials or customer data, and writes an immutable audit event for every scope change, dispatch, result, approval, and export.
Deny-first. Nothing dispatches unless tenant, scope, authorization, runner trust, isolation, rate limits, and emergency stop all pass.
Coverage
Agent surfaces
Claude Code
Full: skill plus pre- and post-tool hooks
OpenClaw
Full: plugin hooks, auto-scan, daily patrol
Hermes Agent
Native pre- and post-tool hooks
Codex CLI, Gemini CLI, Cursor, GitHub Copilot
Skill: scan, action, trust
Any MCP host
MCP server integration
Threat coverage
Execution and supply chain
Malicious skills, remote loaders, piped install scripts, auto-update backdoors
Secrets and credentials
Environment, SSH, and keychain access, private keys, mnemonics
Data exfiltration
Webhook and tunnel egress, sensitive-path reads
Prompt injection
Role hijacking, system-prompt extraction, encoded and zero-width payloads
Agent-specific
Tool-approval bypass, MCP escalation, RAG leakage
Web3
Wallet draining, unlimited approvals, reentrancy, flash-loan risk
Editions
AgentGuard Guard. Free and local-first. The developer's security guard, protecting an individual machine with no account required. This is the adoption layer.
AgentGuard Cloud. For teams. Central policy, approvals, audit timelines, supply-chain reputation, and the threat-intelligence feed, self-serve.
AgentGuard Enterprise. On-premise and license-based. The full control plane, discovery, validation, runtime governance, and threat intelligence, deployed inside the customer's own infrastructure, designed for offline and air-gapped operation and enterprise identity.
AgentGuard and $GPS
Every AgentGuard decision is a metered security service. Each action evaluation, deep scan, daily patrol, and validation run is a discrete unit of security consumption, and because agents act continuously, consumption scales with agent activity rather than with the number of human users.
Team and enterprise plans are priced in security-service units that settle in $GPS. Where customers pay in fiat or stablecoins, GoPlus intends to route a defined share of that revenue into $GPS-denominated settlement on the network side. When AgentGuard protects agents that also consume GoPlus Intelligence through the AI Agent Security API, both the runtime decision and the underlying intelligence call are part of the same $GPS-settled service economy. The signed advisories and detection rules AgentGuard relies on are produced by data contributors and Security Compute Layer operators who stake and earn $GPS.
Conclusion
Axora AgentGuard gives the enterprise a live inventory of its AI agents, proves they are safe by validating them, stops malicious actions at runtime, and governs the whole program from a single, deny-first control plane, deployable inside the customer's own infrastructure. It protects action, the second control point in the Axora boundary, and each decision is a metered service settled in $GPS.
Last updated