@veridex/agent-security

Framework-agnostic agent security gateway. Protect any AI agent — LangChain, CrewAI, AutoGPT, OpenAI Agents SDK, Veridex, or your own — with versioned security packs that address the OWASP LLM Top 10 and MCP threat model.

Status

Beta. Production-deployed at Veridex. Public API stabilising for 1.0.

Why this package exists

Most agent frameworks treat security as the developer's problem. The result is a long-tail of LLM01–LLM10 failures: prompt injection, tool poisoning, secret exfiltration, runaway spend, confused-deputy handoffs. @veridex/agent-security packages the mitigations as versioned, composable security packs that drop into any agent — Veridex or otherwise — via in-process gateway or HTTP/MCP sidecar.

Installation

npm install @veridex/agent-security
# or
pnpm add @veridex/agent-security

Quick Start

In-process

import { SecurityGateway, createDefaultPacks } from '@veridex/agent-security';

const gateway = new SecurityGateway({ packs: createDefaultPacks() });

const result = await gateway.evaluate({
  agent: { agentId: 'support-1', framework: 'langchain' },
  action: { type: 'tool_call', toolCalls: [{ name: 'bash', arguments: { cmd: 'ls /' } }] },
});

if (result.verdict === 'deny') {
  throw new SecurityError(result.reason);
}

HTTP sidecar (any framework)

import { SecurityClient } from '@veridex/agent-security';

const client = new SecurityClient({
  gatewayUrl: 'http://localhost:3100',
  apiKey: process.env.VERIDEX_SECURITY_KEY!,
  defaultAgent: { agentId: 'crewai-team-1', framework: 'crewai' },
});

const check = await client.checkToolCall('bash', { cmd: 'rm -rf /' });
// → { verdict: 'deny', reason: 'shellCommandSafetyPack: destructive command' }

Framework adapters

import { VeridexLangChainGuard } from '@veridex/agent-security/adapters/langchain';
import { VeridexCrewAIGuard }     from '@veridex/agent-security/adapters/crewai';

// Drop into an existing LangChain executor:
executor.callbacks.push(new VeridexLangChainGuard(gateway));

Security Packs

Pack	Addresses	What it does
injectionDetectionPack	LLM01 (Prompt Injection)	Heuristic + classifier-based detection on untrusted input
toolPoisoningPack	MCP TPA / LLM05	Detects hostile instructions in tool descriptions
secretDetectionPack	LLM02 / LLM10	Detects secrets in inputs and outputs
budgetCeilingPack	LLM10 (Unbounded Consumption)	Per-run / per-tenant / per-window spend caps
shellCommandSafetyPack	LLM05 / Command Injection	Denies destructive shell patterns
endpointAllowlistPack	Data exfiltration	Restricts outbound HTTP egress
handoffSafetyPack	Confused Deputy	Validates identity on A2A/ACP handoffs
piiStrictPack	LLM02	Denies or redacts PII in tool I/O
supplyChainPack	LLM06	Verifies tool signatures and provenance
canaryCredentialsPack	LLM10	Plants honeypot creds; emits security event on access
transparencyLogPack	Audit integrity	Anchors event chain roots to an external log

Default bundle:

import { createDefaultPacks } from '@veridex/agent-security';

const packs = createDefaultPacks({
  budgetCeiling: { perRunUsd: 5 },
  endpointAllowlist: ['api.stripe.com', 'api.openai.com'],
});

Key Features

Hardened fetch wrapper

import { createSecureFetch } from '@veridex/agent-security';

const fetch = createSecureFetch({
  endpointAllowlist: ['api.openai.com'],
  canaryScan: defaultCanaryScan,           // detects honeypot creds in responses
  tlsValidator: defaultTLSValidator,        // pinning + min version
  onViolation: (v) => logger.warn(v),
});

Token-bucket rate limiting

import { TokenBucketRateLimiter } from '@veridex/agent-security';
const limiter = new TokenBucketRateLimiter({ capacity: 100, refillPerSecond: 10 });
const decision = await limiter.consume({ key: `tenant:${tenantId}`, cost: 1 });

Telemetry

Every verdict emits a structured SecurityTelemetryEvent with a taxonomy field. Route to your SIEM:

import { TelemetryReporter } from '@veridex/agent-security';

const reporter = new TelemetryReporter({
  endpoint: 'https://siem.example.com/ingest',
  apiKey: process.env.SIEM_KEY!,
});

gateway.onEvaluate((event) => reporter.report(event));

Documentation

• Security Packs overview
• Transports & PEP
• Tools & safety classes
• ADRs: 0052, 0053, 0057

Comparison

Capability	@veridex/agent-security	Hand-rolled per-agent
Versioned, composable packs	✅	rare
Framework-agnostic gateway	✅ in-proc + HTTP	usually framework-locked
Hardened fetch + canary creds	✅	rare
Telemetry → SIEM	✅ structured	logs
Adapter for LangChain, CrewAI, MCP	✅	DIY

Ecosystem

• Runtime: @veridex/agents
• Treasury policy: @veridex/agents-treasury
• Control plane policy distribution: @veridex/agents-control-plane
• Adapters for incremental migration: @veridex/agents-adapters

License

MIT — see LICENSE.