Pipelock is an open-source agent firewall. It scans HTTP, WebSocket, and MCP traffic routed through it for credential leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured.

iron-proxy is an open-source egress proxy for AI agents. Its core idea is boundary secret rewriting: the proxy holds the real secrets, the sandbox only ever sees placeholder tokens, and the proxy swaps them in at egress. A compromised sandbox can’t leak a credential it never had. Around that core it has grown a domain allowlist, TLS-terminating inspection, MCP tool authorization, a policy model it calls the LLM Judge, and a fleet control plane. The repository moved to the paradigmxyz GitHub organization; the old path redirects.

Pipelock is an open-source agent firewall. It scans HTTP, MCP, and WebSocket traffic routed through it for credential leaks, injection, SSRF, and tool poisoning, can emit signed action receipts for mediated decisions when a signing key is configured, and runs as a single self-hosted binary.

Runlayer describes an AI control plane with MCP access governance and configurable inspection of tool definitions, arguments, and outputs. Its site lists a catalog of more than 18,000 MCPs, shadow AI discovery across unmanaged agents and client configs, and SOC 2, HIPAA, and GDPR badges. Its Natoma comparison post says it sits between more than 300 MCP clients and their servers. Its deployment docs describe Runlayer-hosted and self-hosted deployment.

An agent authorization gateway answers one question before a tool call happens: may this agent, on behalf of this user, call this tool with this scope? The identity products (Arcade, Auth0’s Auth for MCP, Aembit, Okta) also answer with which credential. Cerbos is a policy decision point: it returns the allow or deny and leaves credentials to the caller.

An agent firewall answers a different question once the call is allowed: what is in it, is it safe, and what did we decide? Pipelock inspects payloads routed through it and can emit signed receipts when a signing key is configured.

Pipelock is a network-layer agent firewall. It scans HTTP requests, WebSocket frames, and MCP tool calls routed through it for credential leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured. It works with any agent whose traffic you can route.

LlamaFirewall is an inference-layer Python library from Meta’s PurpleLlama project. It runs three scanners: PromptGuard classifies inputs with a fine-tuned model, AlignmentCheck audits the agent’s chain of thought with a second model, and CodeShield runs static analysis on generated code.

A WAF (web application firewall) sits in front of a web server. It blocks inbound attacks: SQL injection, cross-site scripting, request smuggling, and the rest of the categories a rule set like the OWASP CRS covers.

An agent firewall sits between an AI agent and the internet. It scans routed outbound requests for credential leaks and routed inbound responses for prompt injection. Pipelock can emit signed action receipts for mediated decisions when a signing key is configured.

Guardrails check the model’s intent before it acts. They run inside the inference pipeline.

An agent firewall checks what goes over the wire after the model acts. It runs at the network layer, outside the agent process.

Guardrails catch bad reasoning. Agent firewalls catch bad traffic. They fail in different ways. Use both.

The trust boundary problem

Guardrails and the model share a trust boundary.

NeMo Guardrails, Guardrails AI, and LlamaFirewall are libraries you import into the application that calls the model, so they sit inside the same trust domain as that call. Where a guardrail uses a classifier model to judge input, it is processing the same text with the same kind of technique the primary model uses. A prompt injection good enough to fool the model therefore has a head start on fooling that guardrail.

Pipelock is an open-source agent firewall. It scans HTTP, MCP, and WebSocket traffic routed through it for credential leaks, prompt injection, SSRF, and tool poisoning. With a signing key configured, it can emit signed action receipts for mediated decisions. Single binary, works with any agent routed through it.

NemoClaw is NVIDIA’s open-source reference stack for running supported AI agents more safely inside OpenShell sandboxes. It provides guided onboarding, managed inference, network policy, managed integrations, snapshots, and lifecycle operations through a CLI. The README lists OpenClaw as the default agent and Hermes and LangChain Deep Agents Code as supported, and calls the project alpha with best-effort maintenance.

Pipelock is an open-source agent firewall that scans HTTP, WebSocket, and MCP traffic routed through it for credential leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured. Single binary, no runtime dependencies.

Docker MCP Gateway is Docker’s open-source MCP orchestrator. It runs MCP servers in isolated containers behind a single gateway endpoint, integrates with the Docker MCP Catalog, packages server sets as shareable profiles, handles OAuth for servers that need it, and verifies server image signatures. The docs note that the gateway as part of Docker’s AI Governance bundle is invite-only; the open-source CLI plugin itself is public and MIT-licensed.

Pipelock is an open-source agent firewall. It scans HTTP, WebSocket, and MCP traffic routed through it for credential leaks, injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured. It works with any framework whose traffic is routed through it.

DefenseClaw is Cisco’s open-source governance layer for AI coding agents. Its docs describe three jobs: govern (scan skills, MCP servers, plugins, and generated code before they run), inspect (prompts, completions, tool calls, and sandbox activity at runtime), and prove (SQLite audit history, JSONL, OTLP, Splunk, webhooks, and a terminal UI). It runs as a Python operator CLI with a TUI, a Go gateway sidecar, and per-agent connectors, and it ships Rego policy files in the repository. Thirteen agents have first-class connectors, from Claude Code and Codex to Cursor, Devin, Hermes, and OpenClaw.

Pipelock is an open-source agent firewall. It scans HTTP, MCP, and WebSocket traffic routed through it for credential leaks, prompt injection, SSRF, and tool poisoning, can emit signed action receipts for mediated decisions when a signing key is configured, and runs as a single Go binary you host yourself.

Prisma AIRS is Palo Alto Networks’ AI security platform. Its product page lists six components: AI Gateway, Agent Security, AI Red Teaming, AI Runtime Security, AI Model Security, and AI Posture Management. The what’s-new timeline on that page adds a managed runtime-security option, MCP threat detection, OAuth token refresh, and token-based API licensing over the past year.

Pipelock is an open-source agent firewall. It runs as a single Go binary on the agent’s routed network path and scans HTTP, WebSocket, and MCP traffic for credential leaks, prompt injection, SSRF, and tool poisoning. With a signing key configured, it can emit signed action receipts for mediated decisions. The verifier checks them offline.

Backslash Security sells what its site calls an agentic AI endpoint security platform. It rates MCP servers, skills, and plugins on security posture and supply-chain risk, lets security teams allowlist, blocklist, or require approval before installation, and surfaces unmanaged agent use on developer machines. The public pieces are the MCP Server Security Hub and a Skills Security Scanner. The enterprise platform covers a long list of AI coding agents and clients.

Open source MCP gateways handle routing, access control, and multi-server policy. Pipelock inspects what flows through its mediated connection and can record its decision. So this is Pipelock next to gateways rather than Pipelock versus gateways.

The honest change since this page was first written: two of the gateways below now document content guardrails of their own. agentgateway ships prompt guards (regex and built-in PII detectors, plus OpenAI moderation, AWS Bedrock Guardrails, Azure AI Content Safety, and Google Model Armor integrations) and an external-policy MCP guardrail hook. Obot documents inspect, reject, and modify filters on MCP requests and responses. That narrows the gap on “content inspection: yes or no”. It doesn’t change the depth: none of them document tool-description fingerprinting, rug-pull drift detection, encoding-aware DLP across HTTP and WebSocket, or signed offline-verifiable receipts.

Pipelock is an open-source agent firewall. It scans HTTP, MCP, and WebSocket traffic routed through it for credential leaks, prompt injection, SSRF, and tool poisoning. With a signing key configured, it can emit signed action receipts for mediated decisions. Single Go binary, self-hosted.

Lakera Guard is a runtime classifier for LLM applications. Check Point acquired Lakera, and the product page now carries the AI Agent Security and AI Guardrails names. The integration shape is a call to the guard API on each model interaction: the application sends the input, optionally the model’s response, and gets back verdicts for prompt injection, jailbreaks, data leakage, unsafe tool use, harmful content, and multilingual or multimodal attacks. SaaS is the default; the docs describe self-hosting via Helm, Docker, or air-gapped containers under an Enterprise license.

Pipelock is an open-source agent firewall. It scans HTTP, WebSocket, and MCP traffic routed through it for credential leaks, prompt injection, SSRF, and tool poisoning and can emit signed action receipts for mediated decisions when a signing key is configured. Single Go binary, self-hosted.

Cloudflare AI Gateway is a hosted gateway between an application and its LLM providers. The integration is a base URL change: the application calls the gateway endpoint instead of the provider directly, and Cloudflare relays the request upstream. The gateway adds caching, rate limiting, retries and provider fallback, analytics on token usage and cost, and two beta features, Guardrails and Data Loss Prevention, that inspect prompts and completions. It supports Workers AI, Anthropic, Google Gemini, OpenAI, Replicate, and other providers, and is available on all Cloudflare plans.

Pipelock is an open-source agent firewall. It inspects HTTP, WebSocket, and MCP traffic routed through it for credential leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured.

ToolHive is Stacklok’s Apache-2.0 runtime for MCP servers. Its README describes running every server in an isolated container with a minimal permission file and no local credentials. Around that it adds encrypted secrets, network isolation and access filtering, a registry of servers, provenance verification and signing, a virtual MCP workflow engine, and a Kubernetes operator with custom resources. With an authentication source configured it enforces identity and access policy per request.

Pipelock is an open-source agent firewall. It inspects HTTP, WebSocket, and MCP traffic routed through it at runtime for credential leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured.

Snyk Agent Scan is an Apache-2.0 scanner from Snyk. Its README describes discovering the agent components installed on a machine, including harnesses, MCP servers, and skills, and scanning them for prompt injections, sensitive data handling, and malware patterns. It installs with uvx or a release binary, runs with a Snyk API token, and warns that scanning an MCP configuration executes the commands defined in it, because that is how it reads the tool descriptions. The Invariant Labs mcp-scan repository redirects here.

Pipelock is an open-source agent firewall. It sits on the network path outside the agent, inspects HTTP, WebSocket, and MCP traffic for credential leaks, prompt injection, SSRF, and tool poisoning, and, once a signing key is configured for its flight recorder (which pipelock contain install does), signs a receipt for every mediated decision from a key the operator holds. Single Go binary, any agent routed through it.

Pipelock is an open-source agent firewall. It inspects HTTP, WebSocket, and MCP traffic routed through it on the agent’s network path for credential leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured.

Envoy AI Gateway, now Agent Router is an Apache-2.0 extension to Envoy Gateway. Its README confirms the rename with the same code and maintainers, under the Agentic AI Foundation. Its docs describe an LLM gateway and an MCP gateway. The MCP side aggregates multiple servers into one endpoint, filters which tools are exposed, authenticates clients with OAuth, and applies access rules from JWT claims, scopes, and CEL expressions. Upstream API keys are injected at the gateway so clients never hold them.

Pipelock is an open-source agent firewall. It inspects HTTP, WebSocket, and MCP traffic routed through it on the agent’s network path for credential leaks, prompt injection, SSRF, and tool poisoning. With a signing key configured, it can emit signed action receipts for mediated decisions.

Amazon Bedrock Guardrails applies configurable filters to model inputs and responses on Bedrock. Its user guide lists content filters for hate, insults, sexual content, violence, misconduct, and prompt attack, denied topics, word filters, sensitive-information filters that block or mask PII, and contextual grounding checks.

Pipelock is an open-source agent firewall. It inspects HTTP, WebSocket, and MCP traffic routed through it on the agent’s network path for credential leaks, prompt injection, SSRF, and tool poisoning. With a signing key configured, it can emit signed action receipts for mediated decisions. It can run beside the agent wherever the deployment routes traffic through it.

AgentCore Gateway is part of Amazon Bedrock AgentCore. Its developer guide describes one endpoint that routes and secures agentic traffic. It converts APIs, Lambda functions, and existing services into MCP-compatible tools from OpenAPI, Smithy, or Lambda definitions, and fronts other agents and HTTP services as passthrough targets, including A2A. It also routes model requests across providers and manages OAuth authorization for who may call it and how it calls upstream. A policy feature evaluates tool calls at the gateway.