DEV Community

AgentGuard
AgentGuard

Posted on

AgentGuard Update: Open Core, Break-Glass Governance — and the First Real-World Finds

#opensource #agents #security #devops

When I posted the launch here on dev.to, the pitch was simple: I attacked my own repo — and my own PR bot blocked the attack before merge. A lot has moved since then. Here's the honest update, including the uncomfortable parts.

1. Open-Core Split: The Line Is Now Public

AgentGuard has been two clearly separated parts since this week:

  • Public (MIT): the deterministic engine with 12 rule classes and the free GitHub Action — 59 tests, every one of them publicly traceable.
  • Private: the Pro components — GitHub App server with check-run gate, multi-tenant, rules editor, re-sharpening, and billing — 26 more tests.

Why the split? Because a CI gate for coding agents is either a hobby or a product. I chose the latter. The community loses nothing: the engine stays MIT, the Action stays free for public repos. The line is documented in LICENSING.md — in plain text, not fine print.

2. Break-Glass Governance: Exceptions That Can't Hide

Every honest security policy needs exceptions. The naive version is the permanent bypass: switch it off once, it stays off forever. Our answer in v0.2.2:

  • A waiver is an issue — an immutable record of who exempted what, and when.
  • Mandatory reviewer, max. 30 days lifetime, automatic expiry.
  • A guardian workflow runs weekly, comments on expired exceptions, and files a warning issue.

And here's the part that matters to me: we don't claim the expiry works — we demonstrate it publicly. A test waiver (#13) runs in our own repo and expires automatically on 16 Sep 2026. The guardian run after that documents it publicly: commented, warned, closed. That's the difference between a policy on paper and one that proves itself. For your own repo: break-glass policy, ADR-002, workflow template.

3. 85 Tests, Self-Scan in Our Own CI

The full suite has grown to 85 tests: 59 in the public engine repo, 26 in the Pro repo. Still deterministic, still no LLM in the scan path. And still dogfooding: the scan of our own repo runs in our own CI — every landing page change has to pass our own gate first. That exact setup has already blocked one of our own PRs. Working as designed; it's all in the changelog.

4. The First Real-World Finds

Two active open-source repos, two invisible characters:

  1. A zero-width space (U+200B) directly before a bash block in an agent-facing spec.
  2. A U+200B in the middle of a skill spec.

Invisible in every diff and every review — but a different file for the model than for the human reading it. That's the documented invisibility trick, not a theoretical scenario. Both finds are byte-verified and were responsibly disclosed to the maintainers — with no public naming. If the maintainers want, there will be an update here.

5. What Pro Does — and What It Costs

  • App server: PR comment + check-run gate per repo, multi-tenant.
  • Rules editor: your own rules as a file, fail-closed.
  • Re-sharpening: generate new rules from real findings.
  • Billing: Stripe checkout, fully wired.

Prices unchanged: Free, Pro $19/repo/month, Audit $499 (one-time), RedTeam $499/quarter.

Try It

Top comments (0)