Free IDE extension for risk-free vibe coding — keep secrets out of AI.
Protect
POST /api/agent-firewall/inspectAI agent firewall that monitors and controls every tool call, API request, and data access your agents make. Prevent data exfiltration, block unauthorized actions, and enforce least-privilege policies.
Complete these steps in order. The dashboard link opens the exact product workspace for this service.
Sign in, select the project you want to protect, then open Agent Firewall.
Every tool call, API request, and action is intercepted before execution by the Agent Firewall SDK.
Use POST /api/agent-firewall/inspect from server-side code. Keep API keys out of browsers and client bundles.
Run one safe case and one expected-risk case. Confirm the result in Agent Firewall, then review Guard Logs before enabling the control for production traffic.
AI agents with tool access can accidentally (or maliciously) exfiltrate data, modify critical systems, or execute unauthorized actions. Agent Firewall acts as a guardrail, inspecting every action before execution and blocking risky operations.
A step-by-step breakdown of how Agent Firewall protects your AI.
Every tool call, API request, and action is intercepted before execution by the Agent Firewall SDK.
Each action is evaluated against your configured policies — checking destination, content, tool type, and risk context.
Actions are ALLOWED, BLOCKED, or sent for human APPROVAL based on policy rules and risk scoring.
Every decision is logged with full context for audit trails, incident investigation, and policy tuning.
Browser, file system, email, terminal, MCP, API, and RAG tool support
Actions scored by risk level with configurable thresholds for allow/block/approve
Detect and block attempts to send sensitive data to external destinations
Risky actions can be routed for human approval with full context
This service is implemented at the application route below. Use the tested SDK and framework guides for copy-paste integration examples.
POST /api/agent-firewall/inspect. API keys must stay server-side. See the REST API guide and related documentation before integrating.