Contain AI agents.
Prove what they did.

agw runs your agents inside a boundary they cannot opt out of, even with root. It refuses what policy does not allow, and it records everything they did and attempted as evidence anyone can verify with a file and a public key. No account, no network, no trust in us.

Get started in five minutes Verify evidence in your browser

curl -fsSL https://aryan22g.github.io/agw/install.sh | sh

Linux · macOS · Windows CLI Kubernetes · Docker · GitHub Actions MCP · OpenTelemetry Apache-2.0

agent with root, trying to leave

$ ./demo/run.shcontained  connect 169.254.169.254:80, no proxycontained  connect 8.8.8.8:53, no proxycontained  add a default route, reach the internetcontained  read the evidence log from insidecontained  CONNECT 169.254.169.254:80 via proxy 403contained  CONNECT evil.example.com:443 via proxy 403contained  CONNECT 10.0.0.1:22, internal pivot 403works      permitted egress to pypi.orgclosed     kill switch on a live connection $ agw-verify --key checkpoint.pub evidence.jsonl43 records, 7 checkpoints, head seq 43VERIFIED

Real output from demo/run.sh. The agent can edit its own routing table, and it changes nothing: the rule that would carry the traffic lives where the agent cannot reach.

Isolation that assumes the agent stays put is not isolation.

The agent “read the EC2 node role credentials from the instance metadata service.” Hugging Face, Anatomy of a Frontier Lab Agent Intrusion, 27 July 2026. The agent came from a cyber-capability evaluation, escaped its sandbox through a zero-day, and later used a harvested signing key to mint its own identity tokens.

Every control that depends on the agent choosing to use it failed the moment the agent stopped cooperating. agw puts enforcement outside the agent's trust domain. It is honest about what that does and does not change.

No effectZero-day in the registry cache proxy; a public eval harness; template injection in a data loader. Someone else's vulnerabilities.
PreventedCredentials from the metadata endpoint. Refused at the proxy and the firewall, whatever the policy says.
ReducedEnvironment secrets. The supervisor's environment no longer crosses into the sandbox.
ReducedOne credential shared across clusters. A confined agent reaches only the destinations its policy names.
TransformedForensics. Every attempt, allowed or refused, in a chain that verifies offline.

Three verbs. Every feature serves one.

Confine

The agent reaches only what policy allows. It cannot opt out, because the enforcement point is outside its trust domain: a network namespace, a sidecar, a firewall rule it cannot remove. Cloud metadata, link-local and NAT64 space are refused no matter what the policy says.

agw run · sidecar-init · proxy

Decide

Every egress and every MCP tool call is checked before it happens, against a default-deny policy, with a stable reason code when refused. The kill switch cuts a running agent off in about a millisecond, and it does not ask the agent first.

agw mcp · agw suspend · agw policy explain

Prove

Every allow and every refusal lands in a hash-chained, signed evidence log, and is recorded before the action. If it cannot be recorded, it does not happen. Anyone can verify the log with a file and a public key.

agw audit verify · agw-verify · RFC-0009

Start by recording. Contain when you are ready.

Each rung works on its own, and each rehearses before it enforces. Stop at whichever one fits. Nobody should have to adopt the whole thing on day one.

0

Record

5 minutes · no risk
agw watch

Signed evidence from the OpenTelemetry your agents already emit. HTTP/protobuf, HTTP/JSON or gRPC, so any exporter works on its defaults.

stop a compromised agent from lying about itself.

1

Rehearse

an hour · no risk
agw watch --policy p.yaml

What policy would refuse, and a policy drafted from real traffic with agw policy suggest. It never drafts the metadata endpoint.

block anything.

2

Enforce tool calls

a day · low risk
agw mcp -- npx your-server

Forbidden MCP tool calls are refused before the server sees them, with one change to your client's config. Tool redefinitions (the rug pull) are detected, and stopped with --pin-tools.

stop an agent that reaches the network some other way.

3

Contain

a week · the defence
sudo agw run -- python agent.py

Default-deny egress the agent cannot bypass even as root. No credentials in the sandbox. A kill switch measured at about a millisecond, with 100 ms asserted in CI.

stop harm within what the policy permits.

It fits where your agents already run.

Each integration was tested against the real third-party component and, for containment, against an agent with root trying to escape. CI runs the tests on every change.

Any agent that emits OpenTelemetry

No SDK and no code change. agw watch prints three variables; set them where your agent runs. OpenAI Agents SDK, LangGraph, Pydantic AI, the Vercel AI SDK, LlamaIndex, CrewAI: anything that emits spans. You can also add one exporter to an existing Collector.

tested · Python SDK 1.41 · Node SDK · Collector 0.161

agw init
agw watch --policy agw-policy.yaml

# in the agent's environment
export OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4318
export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

# later
agw audit show agw-evidence-*.jsonl --would-deny
agw policy suggest agw-evidence-*.jsonl --out drafted.yaml

Claude Desktop, Cursor, Claude Code, VS Code

Put agw mcp … -- in front of the server's command. Refusals come back as MCP errors the model sees, not transport failures it retries. Messages crafted so that agw and the server would read them differently are refused.

tested · official MCP SDK client + server-filesystem

claude_desktop_config.json · .cursor/mcp.json · .mcp.json

{
  "mcpServers": {
    "filesystem": {
      "command": "agw",
      "args": ["mcp", "--policy", "/abs/agw-actions.yaml",
               "--agent", "my-agent", "--pin-tools", "--",
               "npx", "-y", "@modelcontextprotocol/server-filesystem",
               "/abs/workspace"]
    }
  }
}

Claude Code

claude mcp add filesystem -- agw mcp --policy /abs/agw-actions.yaml \
  --agent my-agent -- npx -y @modelcontextprotocol/server-filesystem /abs/workspace

One command: contained, recorded, verifiable

The command runs in its own network namespace. Its only way out is a proxy that enforces policy, backed by a firewall it cannot remove. Nothing from your shell's environment crosses unless you name it. agw suspend from another terminal cuts connections, refuses new ones and kills the process group.

tested · as root on Linux · kill switch asserted in CI

sudo agw run --policy agw-policy.yaml \
  --env OPENAI_API_KEY -- python agent.py

# from another terminal
sudo agw suspend --workload my-agent --reason "anomalous behaviour"
#   connections closed  2
#   teardown            246µs

A native sidecar, with the cluster enforcing its preconditions

An init step lets only the proxy's UID leave the pod. An admission policy then refuses pods whose other containers keep capabilities, run as the proxy's UID or use the host network. It also refuses a kubectl debug container with NET_ADMIN added later.

tested · Kubernetes 1.33 · root attacker in the pod

K=https://raw.githubusercontent.com/Aryan22g/agw/main/integrations/kubernetes
kubectl apply -f $K/admission-policy.yaml   # once per cluster, 1.30+
kubectl apply -f $K/confined-agent.yaml

# label your own pods, keep the agent's securityContext:
#   metadata.labels:  agw.dev/confined: "true"
#   capabilities:     drop: ["ALL"]

Three services, one network namespace

Replace the agent's image with yours and keep cap_drop: [ALL]. The test runs this exact file against an agent with root: direct egress, direct DNS, flushing the firewall and switching to the proxy's UID all fail.

tested · adversarially · CI

git clone https://github.com/Aryan22g/agw && cd agw/integrations/docker-sidecar
docker compose run --rm agent   # start agw, install the rule, run the agent once

# agent service:
#   network_mode: service:agw
#   cap_drop: [ALL]
#   environment: HTTPS_PROXY=http://127.0.0.1:8080

Contained evals in CI

Run an agent or eval harness contained. The step fails if the evidence does not verify. The evidence, its public key and a summary of every refusal are uploaded for a reviewer to check offline.

CI

- uses: Aryan22g/agw/integrations/github-action@v0.1.0
  with:
    policy: eval/egress.yaml
    command: python run_eval.py --tasks 400
    env: OPENAI_API_KEY

Verify evidence right here. Nothing leaves your machine.

This is a complete, independent verifier running in your browser. Its specification is RFC-0009, it passes the same conformance corpus as the two Go verifiers, and it agrees with them on thousands of randomly mutated logs. The sample is the real log from the demo above.

Loading the sample…

What it does not stop.

We do not prevent agents from going rogue. We bound what a rogue agent can reach, and make everything it attempted provable. Here is where that line falls, with the test behind every “yes”.

Failure	Stopped?	Why
Harm within the agent's permitted scope	No	That is alignment. Policy cannot tell a legitimate call from a harmful one when both are allowed.
Prompt injection causing a permitted action	No	The action is permitted. Policy cannot see intent.
Kernel or hypervisor escape	No	The substrate's job: gVisor, Firecracker.
Secrets sent to a permitted destination	No	Destination policy decides where, not what. Our own test environment does this on every run, and it is recorded every time. Stopping it needs payload inspection, which is not built yet. gym: exfil.via_allowed_*
Unauthorized egress, direct or through the proxy	Yes · rung 3	Default-deny egress the agent cannot bypass, even as root. netns tests as root · Kubernetes and Compose tests
Cloud credentials from the metadata endpoint	Yes · rung 3	Refused whatever policy says, and cannot be exempted. TestMetadataEndpointIsUnreachable
A forbidden MCP tool call	Yes · rung 2	Refused before the server sees it, including messages two parsers would read differently. TestEnforcementPointAndServerReadTheSameCall
Acting after the kill switch	Yes	Connections cut, process group killed. Measured at about a millisecond; CI asserts 100 ms. scripts/killswitch-e2e.sh
An action that is never recorded	Yes	Fail closed: if the decision cannot be written, the action does not happen. gym failclosed.* · TestAnUnrecordedCallIsNeverForwarded
Deleting the most recent evidence	With an anchor	Records after the last checkpoint can be removed without trace from the file alone. A checkpoint kept elsewhere detects it. Live logs are checkpointed every 10 s. TestAnchorDetectsRollback

The full coverage table lists every class and the test behind each.

Tested like an attacker would test it.

An adversarial environment, scored by the worldA generated enterprise with a hostile agent in it. Each service keeps its own receipt of what it received, and that is compared with the evidence agw wrote. Egress with no record is the one failure a product cannot report about itself. 9,450 episodes across 150 generated worlds: none.
Root, on real Linux, in CIThe containment tests build real namespaces and firewall rules, then check that an agent with root cannot reach the metadata endpoint or remove the rules. CI fails if they are skipped.
Three verifiers, one specificationGo, standard-library Go and JavaScript implementations, written separately and run against each other on thousands of mutated logs. Where they disagreed, the specification was ambiguous or one of them was wrong.
Against the real thingThe official MCP client and server, the Python and Node OpenTelemetry SDKs, the OpenTelemetry Collector, a Kubernetes cluster and Docker Compose, each with the configuration published here.

What that testing found in our own code

Published, because the way to trust a security product is to see how its failures were found and fixed. SECURITY.md keeps the list.

A crafted MCP message was authorized as one method and executed as a forbidden tool call.found by a server that parses like Node and Python do
A verified log could display a decision other than the one that was signed.found by differential testing of two verifiers
The policy allowlist could be used to reopen the cloud metadata range.found by the adversarial environment
The sandbox inherited the operator's environment, credentials included.found by running agw run for real
Keeping the signing key in a separate process stopped all traffic at the first checkpoint.found by testing separate custody end to end
Two verifiers wrapped around to 1.8×10¹⁹ “unanchored records” on a reordered log.found by the JavaScript verifier on this page

Built for the rooms where this matters most.

Labs and evaluators

Run an agent against a benchmark with shell and network access, contained, and publish the evidence alongside the paper. A reviewer verifies it offline, air-gapped, with no account. You get a containment control and a reproducibility artifact from one command.

sudo agw run --policy eval.yaml -- python harness.py

Platform and security teams

Start with a record of what your production agents actually do. Draft a policy from it, rehearse it, then enforce it one agent at a time. Each step is defensible in a change review on its own. When something goes wrong at 03:00, cut the agent off in about a millisecond and reconstruct from a log nobody could have edited.

agw suspend --workload agent-support-01

Compliance

EU AI Act Article 12 asks for automatic, tamper-evident event logs over a system's lifetime, kept for at least six months. agw records at a point the agent cannot bypass, without storing payloads, and exports bundles a third party can verify. The article-by-article mapping says what it covers and what it does not.

agw audit export evidence.jsonl --from 2026-07-01T00:00:00Z --out q3.json

Evidence you do not have to trust us for.

Verification that only a vendor can perform is not verification. The evidence format is a specification a stranger can implement, with test vectors that check whether they did.

RFC-0009The evidence chain: an exact byte encoding, signed checkpoints, and a normative verification algorithm with stable problem codes.

39 conformance vectorsExpected results written from the specification, including every edge where common JSON and timestamp parsers disagree.

3 implementationsThe reference, agw-verify (one file, standard library, no sockets) and the JavaScript on this page.

Read RFC-0009 Conformance corpus IETF agent-audit-trail export AGS1 request signing (RFC 9421)

Five minutes from now.

1

Install. Linux and macOS, amd64 and arm64. The script checks the release checksum before installing anything.

curl -fsSL https://aryan22g.github.io/agw/install.sh | sh

Or go install github.com/Aryan22g/agw/cmd/agw@latest, or docker run ghcr.io/aryan22g/agw.

2

Create a signing key and a starter policy. The command prints the next command for each rung.

agw init

3

Record, then verify. Anyone you give the public key to can do the second part.

agw watch

agw audit verify agw-evidence-*.jsonl --key ~/.agw/checkpoint.key.pub

Integration guide Source on GitHub

Contain AI agents.Prove what they did.