AgentGuard 1.1: An Open-Source Firewall for Inter-Agent AI Messages

I used to think the scary part of AI agents was the model hallucinating.

It isn’t.

The scary part is when your system looks fine — green logs, clean outputs, a polite writer agent producing a report — and somewhere in the middle, one message quietly changed the mission.

Not because a user typed something evil.

Because a researcher agent fetched a page. Because a tool returned poisoned text. Because the next agent trusted its teammate the way we trust people we work with every day.

That trust is beautiful in teams.

In multi-agent systems, it is also the hole.

You wire orchestrator → researcher → writer.

You watch them hand work to each other.

It feels like collaboration.

Then one day it clicks: nobody is standing between them.

We put guardrails on the front door — user → model.

We leave the hallway between agents unlocked.

I looked for an open-source tool that treated those messages as untrusted. Not a chatbot filter. Not another “be careful with prompts” blog. Something in the path that says: this hop is not safe until we prove it.

I didn’t find it.

So I built AgentGuard — open source. A firewall for the conversations agents have with each other.

pip install inter-agent-guard   # import as agentguard

If that unlocked-hallway unease is familiar — stay. This is for you.

Two commands. Same pipeline. Different ending:

git clone https://github.com/nizba06/agentguard.git
cd agentguard
pip install -e ".[all]"
python scripts/download_release_model.py   # ~164 MB INT8 — needed for the secured demo

python examples/vulnerable_pipeline/pipeline.py

python examples/secured_pipeline/pipeline.py

First run: gut punch.

Second run: relief.

Same pipeline. Different outcome. That’s the point.

What it does on every hop

Less “another AI package.” More the colleague who finally checks the handoff before anyone acts on it.

Why you can trust the story

Why you should also trust the limits

CPU ML latency is still ~3.4 s P95. That is above the original 15 ms design target. Use GPU, async inspection, or rules-only on hot paths.

Trust is connection that survives the fine print.

Belief dies when day one is painful. So the adoption path is gentle on purpose:

from agentguard import AgentGuard, CapabilityManifest

guard = AgentGuard(
    risk_threshold=0.85,
    task_objective="Analyse Q3 competitor pricing",
    require_ml_model=False,  # start here — no giant model download
)
guard.register_agent(
    "researcher",
    CapabilityManifest.from_yaml("manifests/researcher.yaml"),
)
secured = guard.wrap(my_langgraph_graph)

AgentGuardMiddleware

for LangChain)

python scripts/download_release_model.py  # ~164 MB, optional upgrade

You don’t need the full stack on day one.

If you are building multi-agent systems, you are not alone in that quiet worry.

Maybe you ship at night as a solo builder.

Maybe your team just wired three agents and felt proud a little too fast.

Maybe a tool return already burned you in a way that “shouldn’t have mattered.”

I built AgentGuard so we could stop pretending the hallway is safe.

If you want to go further:

Stars help people find the repo. Issues and stories help it get better.

Personal open-source. Built because the gap bothered me enough to stay up for it.

If the unlocked hallway bothers you too — star the repo, try a wrap, or open an issue.