Your AI Agent Has Too Much Power

A developer has released AvantGate, an open-source TypeScript library that enforces guardrails, PII redaction, budget limits, and tool-call validation in-process rather than through an external LLMOps stack. The project, whose in-process engine is called AG-Men, aims to stop prompt injection, token-loop budget drain, and unauthorized tool side effects before they reach backend APIs. The author argues that container-heavy monitoring setups such as Langfuse, Helicone, and OpenLit often cost lean teams more in maintenance and compute than the LLM calls themselves.

If you've connected an LLM to tool calling, APIs, or database queries recently, you know the feeling: agents are terrifyingly unpredictable. Giving an LLM the ability to decide its own next step means shifting from passive text generation to active system execution . In demos, it looks like magic: the agent reasons, picks a tool, fetches data, and loops until the task is solved. In real life? The traditional answer to this is the classic LLMOps sledgehammer : spin up Docker containers for Langfuse, Helicone, OpenLit, a vector database, ClickHouse, Redis, and an S3 bucket just to trace calls and apply basic guardrails. For most developers and lean teams, the monitoring infrastructure ends up costing more in maintenance and compute than the LLM calls themselves. There is a better way: handling security, guardrails, and cost controls in-process , directly at the application runtime level. When building autonomous workflows or multi-step agents, security vulnerabilities aren't theoretical — they fall into three clear failure modes: User / External Input │ ▼ ┌───────────────┐ │ Prompt / │ <-- 1. Prompt Injection / Malicious Context │ Ingested Data │ └───────┬───────┘ ▼ ┌───────────────┐ │ LLM Engine │ <-- 2. Token Loop & Budget Drainage Hallucination └───────┬───────┘ ▼ ┌───────────────┐ │ Tool Execution│ <-- 3. Unauthorized Side-Effects / PII Exfiltration └───────────────┘ Meet AG-Men avantGate's in-process engine : a tiny, sub-millisecond guardian that sits directly between your model's thoughts and your backend APIs. Avant Gate https://github.com/thienban/avantGate runs directly in your TypeScript process. Imagine a user submits an invoice query packed with an indirect prompt injection and a customer's raw credit card. Here is how the AG-Men defend your runtime step by step: 529 Overloaded . The Shapeshifter catches the fall mid-air and swaps to a backup provider, landing the mission safely without a glitch. Here is how you wrap your agent runtime with avantGate in TypeScript: js import { AvantGate } from 'avantgate'; const gate = new AvantGate { budget: { maxCostPerMinute: 0.50, // Circuit breaker: halts calls if threshold is reached maxTokensPerTurn: 4000 }, pii: { redact: 'email', 'credit-card' , maskChar: ' ' }, fallback: 'anthropic/claude-3-5-sonnet', 'openai/gpt-4o-mini' } ; In an agentic workflow, you must never let the model invoke tools with unchecked parameters. You can intercept and validate both the step input and the agent's intent: js import { z } from 'zod'; // Define strict contract for the tool const SearchDatabaseSchema = z.object { query: z.string .max 200 , limit: z.number .int .min 1 .max 20 , } ; async function runSecuredAgentStep userPrompt: string { // 1. AvantGate sanitizes input PII redaction & checks budget in-process const safeExecution = await gate.run async context = { const response = await context.completion { model: 'anthropic/claude-3-5-sonnet', messages: { role: 'user', content: userPrompt } , tools: { name: 'search database', description: 'Search internal records', parameters: SearchDatabaseSchema, }, , } ; // 2. Validate agent tool calls before execution if response.toolCalls { for const call of response.toolCalls { if call.name === 'search database' { const validatedArgs = SearchDatabaseSchema.parse call.args ; return await executeInternalSearch validatedArgs ; } } } return response.content; } ; return safeExecution; } If an injection attempts to inject DROP TABLE or trigger a recursive chain that blows past your token limits, avantGate halts the execution context before it wrecks your infrastructure. | Concern | External LLMOps Stack | In-Process Control Plane avantGate | |---|---|---| | Infra overhead | Docker, Postgres, ClickHouse, Redis | Zero Pure TypeScript module | | Network Latency | Additional network hops per call | Sub-millisecond runs in memory | | Data Privacy | Prompts/logs stored in external databases | Zero egress data never leaves your runtime | | Maintenance | Migrations, backups, version upgrades | Update avantGate | Agents are the future of software engineering, but building agents without deterministic boundaries is an invitation for disaster. You don't need a 5-container infrastructure stack to build secure, cost-contained AI tools. Check out the project and docs on GitHub: 👉 Avant Gate https://github.com/thienban/avantGate