This is the demo:
[1] Agent reads .env → allowed (internal tool)
[2] Agent posts a harmless report → 200 OK
[3] Injection tries to send .env out → BLOCKED
[4] Same try, secret base64-encoded → BLOCKED
Cerbere remembers the secret the agent read. If it appears in an external tool call, the call stops before it runs. Base64, hex or URL-encoded too.
Open source 👇
chrismsmr-celcom
/
cerbere-AG
Welcome to cerbere-agent guard, originally just agent guard, then rebranded after the mythical hound of the underworld. Our mission? Guarding your AI agents, keeping them in line, and blocking unauthorized actions. Think of it as the ultimate guard dog for AI security and guardrails. 🐕🛡️
Cerbere AG
The three-headed guardian of AI agents.
Runtime security & observability for autonomous agents: it sits between the model's decision and the real-world side effect.
Website · Quick start · Taint tracking · MCP · Benchmark · Roadmap
Why Cerbère
Prompt filtering checks what an agent is told. It cannot tell you whether the action the agent is about to take is safe
An innocent prompt can still produce update_customer(role="admin"), an http_post carrying your .env, or fifty refunds in a loop.
Cerbère enforces policy at the execution boundary: every LLM call and tool call is inspected, scored and decided
(ALLOW, REQUIRE APPROVAL or BLOCK) before it touches a database, an API or an inbox, and every decision leaves evidence.
Prompt analysis stays useful. Cerbère adds the layers that come after it: tool policy, budgets, data-flow tracking and human approval.
Top comments (0)