AgentGuard 1.1: An Open-Source Firewall for Inter-Agent AI Messages

A developer built AgentGuard, an open-source firewall for inter-agent AI messages, to address the security gap in multi-agent systems where messages between agents are often left untrusted. The tool, available on GitHub, allows developers to inspect and block attacks on agent-to-agent communication, with a CPU ML latency of ~3.4 s P95 and support for GPU or rules-only modes.

I used to think the scary part of AI agents was the model hallucinating. It isn’t. The scary part is when your system looks fine — green logs, clean outputs, a polite writer agent producing a report — and somewhere in the middle, one message quietly changed the mission. Not because a user typed something evil. Because a researcher agent fetched a page. Because a tool returned poisoned text. Because the next agent trusted its teammate the way we trust people we work with every day. That trust is beautiful in teams. In multi-agent systems, it is also the hole. You wire orchestrator → researcher → writer. You watch them hand work to each other. It feels like collaboration. Then one day it clicks: nobody is standing between them. We put guardrails on the front door — user → model. We leave the hallway between agents unlocked. I looked for an open-source tool that treated those messages as untrusted. Not a chatbot filter. Not another “be careful with prompts” blog. Something in the path that says: this hop is not safe until we prove it. I didn’t find it. So I built AgentGuard — open source. A firewall for the conversations agents have with each other. python pip install inter-agent-guard import as agentguard If that unlocked-hallway unease is familiar — stay. This is for you. Two commands. Same pipeline. Different ending: git clone https://github.com/nizba06/agentguard.git cd agentguard pip install -e ". all " python scripts/download release model.py ~164 MB INT8 — needed for the secured demo python examples/vulnerable pipeline/pipeline.py → ATTACK SUCCEEDED python examples/secured pipeline/pipeline.py → ATTACK BLOCKED First run: gut punch. Second run: relief. Same pipeline. Different outcome. That’s the point. What it does on every hop Less “another AI package.” More the colleague who finally checks the handoff before anyone acts on it. Why you can trust the story Why you should also trust the limits CPU ML latency is still ~ 3.4 s P95 . That is above the original 15 ms design target. Use GPU, async inspection, or rules-only on hot paths. Trust is connection that survives the fine print. Belief dies when day one is painful. So the adoption path is gentle on purpose: python from agentguard import AgentGuard, CapabilityManifest guard = AgentGuard risk threshold=0.85, task objective="Analyse Q3 competitor pricing", require ml model=False, start here — no giant model download guard.register agent "researcher", CapabilityManifest.from yaml "manifests/researcher.yaml" , secured = guard.wrap my langgraph graph LangChain 1.0 agents: AgentGuardMiddleware guard in create agent middleware= ... AgentGuardMiddleware for LangChain python scripts/download release model.py ~164 MB, optional upgrade You don’t need the full stack on day one. If you are building multi-agent systems, you are not alone in that quiet worry. Maybe you ship at night as a solo builder. Maybe your team just wired three agents and felt proud a little too fast. Maybe a tool return already burned you in a way that “shouldn’t have mattered.” I built AgentGuard so we could stop pretending the hallway is safe. If you want to go further: | Goal | Action | |---|---| | See it work | Run the two demos above | | Try it on your stack | Wrap one real graph or add AgentGuardMiddleware | | Help improve it | Open an issue with an attack we miss | Stars help people find the repo. Issues and stories help it get better. Personal open-source. Built because the gap bothered me enough to stay up for it. If the unlocked hallway bothers you too — star the repo, try a wrap, or open an issue.