AGENT SECURITY · OPEN SOURCE

xAIDR

Runtime security for AI agents. It runs inside the agent, on the execution path, and it is open source.

Most guardrails judge what a model says. Agents are dangerous because they act. xaidr inspects the input, the tool call, the model output, and agent-to-agent messages, and can stop an action before it happens.

pip install xaidr

Apache 2.0. Zero required dependencies. Python 3.10 or newer.

View on PyPI

Get started

View on GitHub

Abstract watercolor security sensor inside an AI agent

WHAT IT IS

A sensor you install inside your agent

xaidr is an open-source security sensor that runs inside your AI agent, on the execution path. It inspects what the agent is about to do and can flag or block it before it happens, and it emits a structured event for every decision. No backend, no account, no network call in the scan path.

Runs in-process. Installs with pip and sits inside your agent, not on the network.

Four boundaries. Inspects the input, the tool call, the model output, and agent-to-agent messages.

Write your own policies. A YAML policy gates what an agent may do, by tool, by impact, by destination.

Approval gates and privilege tiers. Require a human for sensitive actions, and stop a low-privilege agent from driving a high-privilege one.

Telemetry to your stack. Emits a structured event per decision to stdout, a file, a webhook, or OpenTelemetry, safe to ship to your SIEM.

Content never leaves. Events carry a hash and a length, not the prompt.

Provenance built in. Records the principal an action was taken on behalf of, and surfaces un-instrumented hops as gaps rather than guesses.

Protects agent-to-agent. Treats the delegation envelope as its own scan path.

Low latency. Median 2.7 ms in-process, with no network call in the scan path.

UNTRUSTED

IN-PROCESS · xAIDR SENSOR

EFFECTS

The agent process

Model and tools, in one process

Untrusted input

Agent

Model, tools

Tools / APIs

Response

Another agent

Input

Tool call

Output

A2A

Every boundary emits a structured event whether or not anything was blocked.

GETTING STARTED

Protect an agent in minutes.

pip install xaidr

Quick start Policy configuration A2A inspection

WHAT IT DOES

Inspect the boundary. Control the action.

DETECT

CONTROL

AUDIT

GOVERN

Prompt injection and jailbreaks

Direct overrides, role-play escapes, system-prompt extraction, and multi-turn escalation across a conversation.

INPUT BOUNDARY MULTI-TURN

Docs

Obfuscated attacks

Attacks hidden with unicode lookalikes, invisible characters, encoding tricks, or deliberate misspellings are resolved before inspection.

UNICODE ENCODING

Docs

Dangerous tool use

Commands are parsed into structure, so what a command acts on matters as much as the verb.

TOOL BOUNDARY

Docs

Sensitive data

Credentials, keys, tokens, and personal data caught on the way in and the way out.

BIDIRECTIONAL

Docs

Agent-to-agent

A first-class scan path for delegation between agents.

View section

AGENT-TO-AGENT

Agent-to-agent is a first-class scan path

When one agent delegates to another, the message is a structured envelope, not prose. A text-only guardrail either skips it or scans raw JSON and drowns in false positives. xaidr treats the envelope as its own boundary.

01 An attack split across several message parts is caught as the single attack it is. 02 Forged and malformed envelopes are detected on the wire format itself. 03 A delegation claiming to continue work the agent was never assigned is surfaced. 04 Much agent-to-agent traffic never crosses a network boundary, so a gateway cannot see it.

Abstract watercolor agent-to-agent delegation

Open sensor, and what the platform adds

Capability

Open sensor

xAIDR platform

Per-agent detection at all four boundaries

✓

Local policy and approval gates

✓

Privilege tiers and circuit breaker

✓

Provenance propagation and audit trail

✓

Telemetry into your own stack

✓

Correlation across agents and sessions

✓

Identity verified against your IdP

✓

Trust scoring and quarantine

✓

Fleet view and console

✓

A single in-process sensor cannot see an attack split across two separate agents, because it has no shared state. That is what the platform is for.

View on GitHub

Talk to us about the platform

PERFORMANCE

Median 2.7 ms in-process (p95 4.7 ms, p99 6.3 ms)

No network call in the scan path

Content is hashed, never transmitted

Latency scales with input size, and very large inputs are bounded.

Secure the next action.

pip install xaidr

View on GitHub

Talk to us about the platform