# AgentGuard 1.1: An Open-Source Firewall for Inter-Agent AI Messages

> Source: <https://dev.to/nizba06/agentguard-11-an-open-source-firewall-for-inter-agent-ai-messages-29el>
> Published: 2026-07-27 22:34:06+00:00

I used to think the scary part of AI agents was the model hallucinating.

It isn’t.

The scary part is when your system looks *fine* — green logs, clean outputs, a polite writer agent producing a report — and somewhere in the middle, one message quietly changed the mission.

Not because a user typed something evil.

Because a researcher agent fetched a page. Because a tool returned poisoned text. Because the next agent trusted its teammate the way we trust people we work with every day.

That trust is beautiful in teams.

In multi-agent systems, it is also the hole.

You wire orchestrator → researcher → writer.

You watch them hand work to each other.

It feels like collaboration.

Then one day it clicks: **nobody is standing between them.**

We put guardrails on the front door — user → model.

We leave the hallway between agents unlocked.

I looked for an open-source tool that treated *those* messages as untrusted. Not a chatbot filter. Not another “be careful with prompts” blog. Something in the path that says: *this hop is not safe until we prove it.*

I didn’t find it.

So I built **AgentGuard** — open source. A firewall for the conversations agents have with each other.

``` python
pip install inter-agent-guard   # import as agentguard
```

If that unlocked-hallway unease is familiar — stay. This is for you.

Two commands. Same pipeline. Different ending:

```
git clone https://github.com/nizba06/agentguard.git
cd agentguard
pip install -e ".[all]"
python scripts/download_release_model.py   # ~164 MB INT8 — needed for the secured demo

python examples/vulnerable_pipeline/pipeline.py
# → ATTACK SUCCEEDED

python examples/secured_pipeline/pipeline.py
# → ATTACK BLOCKED
```

First run: gut punch.

Second run: relief.

Same pipeline. Different outcome. That’s the point.

**What it does on every hop**

Less “another AI package.” More the colleague who finally checks the handoff before anyone acts on it.

**Why you can trust the story**

**Why you should also trust the limits**

CPU ML latency is still ~**3.4 s P95**. That is above the original 15 ms design target. Use GPU, async inspection, or **rules-only** on hot paths.

Trust is connection that survives the fine print.

Belief dies when day one is painful. So the adoption path is gentle on purpose:

``` python
from agentguard import AgentGuard, CapabilityManifest

guard = AgentGuard(
    risk_threshold=0.85,
    task_objective="Analyse Q3 competitor pricing",
    require_ml_model=False,  # start here — no giant model download
)
guard.register_agent(
    "researcher",
    CapabilityManifest.from_yaml("manifests/researcher.yaml"),
)
secured = guard.wrap(my_langgraph_graph)
# LangChain 1.0 agents: AgentGuardMiddleware(guard) in create_agent(middleware=[...])
```

`AgentGuardMiddleware`

for LangChain)

```
python scripts/download_release_model.py  # ~164 MB, optional upgrade
```

You don’t need the full stack on day one.

If you are building multi-agent systems, you are not alone in that quiet worry.

Maybe you ship at night as a solo builder.

Maybe your team just wired three agents and felt proud a little too fast.

Maybe a tool return already burned you in a way that “shouldn’t have mattered.”

I built AgentGuard so we could stop pretending the hallway is safe.

**If you want to go further:**

| Goal | Action |
|---|---|
| See it work | Run the two demos above |
| Try it on your stack | Wrap one real graph (or add `AgentGuardMiddleware` ) |
| Help improve it | Open an issue with an attack we miss |

Stars help people find the repo. Issues and stories help it get better.

Personal open-source. Built because the gap bothered me enough to stay up for it.

If the unlocked hallway bothers you too — star the repo, try a wrap, or open an issue.