Zero External Dependencies • <0.25ms p50 Latency • 100% Local In-Memory · 📦 PyPI v0.1.0 ↗

The Deterministic
Guardian Gate for AI Agents.

AgentPrahari wraps LLM workflows, autonomous tools, and LangChain/CrewAI pipelines with strict fail-closed boundary gates. Intercept prompt injections, destructive terminal operations, SQL payload injections, and runaway loops in-memory under 1 millisecond.

$ pip install agentprahari

lock Drop-in Guide (shield.wrap) terminal Try Custom Prompt Sandbox

OpenTelemetry Ready • No OpenAI / Cloud Lock-in • Pure In-Memory AST

GATE IDENT // AP-AST-01 | < 0.18ms

PARSER: AST In-Memory

DISPOSITION: Fail-Closed Default

p50 CPU Latency

< 0.25 ms

Pure in-memory parsing; 0 GPU weight calls.

Adversarial Suite

442 Cases

49 adversarial zero-day attack categories.

Safety Paradigm

Fail-Closed

Zero hallucination pass-through on anomaly.

Cloud Isolation

0 Cloud Hops

All verification runs locally inside process memory.

terminal Interactive Security Sandbox

Live Threat Interceptor & Custom Playground

Type any custom prompt, paste arbitrary commands, or choose a preset vector below. Watch AgentPrahari evaluate AST rules and return instant deterministic verdicts.

PRESETS:

LIVE EVALUATOR ACTIVE

Untrusted Inbound Input

HTTP INGESTION

INBOUND_PROMPT_BUFFER 0 chars

Detected Vector: System Override Check

Analyzers Applied: Homoglyph, Unicode, Base64, AST

verified_user Deterministic Gate Engine

0.142 ms Latency

gpp_bad

ActionDecision.BLOCK Fail-Closed

Rule: PROMPT_INJECTION_OVERRIDE_01

STRUCTURED_AUDIT_LOG format: JSON (RFC 8259)

Canonicalization

0.038 ms

AST Evaluator

0.068 ms

Hash & Ledger

0.036 ms

account_tree Deterministic Pipeline

9-Layer Unskippable Defense Pipeline

Every inbound completion, autonomous tool invocation, and outgoing response traverses an immutable sequential guard before reaching your models or agent executors.

TIER 01 / 09 input

Payload Ingestion

Captures raw completions, streaming tokens, or autonomous tool dispatch specs (`tool_calls`, `func_name`, `args`).

Target: Inbound Vectors

TIER 02 / 09 spellcheck

Bounded Canonicalization

Normalizes URL encodings, Cyrillic/Greek homoglyphs, zero-width spaces, and nested Base64 strings before security checks evaluate.

Latency: ~0.038ms CPU

TIER 03 / 09 enhanced_encryption

Input Guards & PII Redactor

Real-time masking of SSNs, emails, credit cards, and addresses utilizing the DiffTracker span engine to preserve character alignment.

Action: Mask · Record Spans

TIER 04 / 09 psychology_alt

Prompt Injection & Overrides

Scans delimiter counterfeits, simulated developer modes, instruction precedence bypasses, and indirect Trojan injection triggers.

Mode: Deterministic Tree Search

TIER 05 / 09 rule

Schema & Privilege Gate

Strict pydantic / JSON-schema validation, Bait-and-Switch tool parameter interception, and Human-in-the-Loop (HITL) pause hooks.

Safety: Schema Enforcement

TIER 06 / 09 terminal

Command & SQL AST Inspector

Tokenizes Bash and SQL commands to detect destructive `DROP`, `TRUNCATE`, inline comment evasions, and shell fork bombs.

Inspect: AST Tree · Comment Strip

TIER 07 / 09 all_inclusive

PathGuard & LoopGuard

Traps `../../` directory escapes and tracks agent cyclic transitions to terminate infinite budget-draining runaway loops.

Defense: Cycle & Traversal Guard

TIER 08 / 09 gavel

Runtime Gate Resolution

Computes unified disposition: ALLOW, SANITIZE, REQUIRE_HITL, or BLOCK.

Resolution: Deterministic Fail-Closed

TIER 09 / 09 lock

SecretLeakGuard & Repair

Detects structural JWT tokens (`eyJ...`), API keys, and automatically repairs truncated JSON tool arguments in-flight.

Egress: Zero Secret Exfiltration

fact_check Empirical Security Verification

442-Case Adversarial Benchmark Suite

Benchmarked against 49 zero-day attack vectors spanning prompt overrides, tool abuse, and destructive terminal injections on a single AMD EPYC 7763 CPU core.

Overall Block Rate

99.8%

False Positive Rate

< 0.8%

Attack Category	Test Corpus	Deterministic Block	Sanitized / Neutralized	p50 Latency	Status
block Direct Prompt Hierarchy Injections	94 Cases	91 (96.8%)	3 (3.2%)	0.142 ms	VERIFIED
terminal Destructive Shell & Fork Bombs	78 Cases	78 (100.0%)	0 (0.0%)	0.089 ms	VERIFIED
database Comment-Obfuscated SQL Attacks	82 Cases	80 (97.5%)	2 (2.5%)	0.115 ms	VERIFIED
folder_open Path Traversal & LFI / RFI Escapes	64 Cases	64 (100.0%)	0 (0.0%)	0.041 ms	VERIFIED
password Structured JWT & Cloud Key Exfiltration	68 Cases	68 (100.0%)	0 (0.0%)	0.076 ms	VERIFIED
repeat Agent Cyclic Loop & Runaway Costs	56 Cases	52 (92.8%)	4 (7.2%)	0.053 ms	VERIFIED

Detailed reproducibility data and benchmark suite logs available in the benchmarks report. View Full Benchmark Details arrow_forward

tune Configurable Governance

Battle-Tested Presets For Every Workload

Zero configuration overhead. Choose from 5 fine-tuned production presets engineered for specific threat surfaces.

strict DEFAULT

Full fail-closed lockdown: blocks shell execution, restricts SQL to SELECT, scrubs all PII, strict schema.


              from_preset("strict")

moderate BALANCED

Permits standard read/write database actions, checks for injection and secret leakage, relaxed tool sandbox.


              from_preset("moderate")

support PUBLIC

Aggressive PII redaction and jailbreak shielding. Disables all raw OS and system execution capabilities completely.


              from_preset("customer_support")

code_agent DEV

Allows compilation and git commands while intercepting `curl | sh`, recursive deletions, and path escapes.


              from_preset("code_agent")

financial PCI-DSS

Mandatory Human-In-The-Loop approval hooks on outbound money movement, ledger calls, or schema drops.


              from_preset("financial")

code 1-Minute Drop-in

Wrap Any LLM SDK With A Single Line.

AgentPrahari intercepts LLM instances non-invasively via functional proxy wrapping. Works out-of-the-box with OpenAI, Anthropic, LangChain, LiteLLM, and CrewAI pipelines.

check_circle Zero rewrite of existing prompt templates or agent tools

check_circle Automatic stream chunk inspection & token-level buffering

check_circle Standardized OpenTelemetry tracing exported out-of-the-box

star Star on GitHub Python 3.10+ · No C++ Compiler

agent_app.py

# 1. Import AgentPrahari and your client
from openai import OpenAI
from agentprahari import AgentPrahari

# 2. Instantiate Guardian shield with default deterministic policy
shield = AgentPrahari.from_preset("strict")

# 3. Wrap your existing LLM client in 1 line
client = shield.wrap(OpenAI()) # Reads OPENAI_API_KEY from environment

# 4. Execute requests as usual; Prahari intercepts automatically!
try:
    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[{"role": "user", "content": user_untrusted_input}]
    )
except shield.SecurityPolicyViolation as err:
    # Clean, fail-closed handling under 0.25ms
    print(f"Intercepted threat: {err.rule_id} | Reason: {err.message}")

LangChain · CrewAI · AutoGPT · DSPy Compatible ✓ 0 GPU VRAM NEEDED

The Deterministic Guardian Gate for AI Agents.