solongate / agent-security

Security Badges 
 Contributing ·
 Security 
---
**SolonGate Agent Security** is SolonGate's open source, local first security
gateway for AI coding agents. It checks tool calls against your policies before
they run, with secret detection, rate limits and a local audit trail.
This repository is the Agent Security gateway. The rest of the portfolio is at
solongate.com.
Everything stays on the machine. The policy is a file, the audit trail is a
file, and the guard makes no network calls. No account, no telemetry.
That last one used to read "contains no code that can open a socket", which
is true of the guard's own source and not of the binary: it links OPA, which
brings `net/http` and a `http.send` builtin along with it. Nothing calls
them, and "makes no calls" is the claim that survives reading the symbol
table.
Agents: **Claude Code**, **Codex**, **OpenCode**, **Antigravity**.
## Install
 [code] 
Then open a new terminal: hooks load when a session starts, so an already open
one is not guarded yet.
## What it looks like when it fires
A real Claude Code session: the agent reaches for a `.env`, the guard refuses it,
and the agent says so rather than quietly working around it.
## What it enforces
| Layer | What it does |
| --- | --- |
| **Policy rules** | Allow or deny by path, command, filename or URL, scoped to READ, WRITE, EXECUTE or NETWORK. |
| **DLP** | 70 built in secret patterns plus your own, in four modes: `off`, `detect`, `redact`, `block`. |
| **Egress** | In block mode, refuses an upload whose file holds a secret, which pattern matching on the call alone cannot see. |
| **Rate limits** | A cap per minute, hour or day. |
| **The prompt** | A shim masks the outbound request body on Claude Code, which no tool call hook can reach. |
| **Tamper protection** | The guard's own state is unreachable from a tool call, and a policy in a repository cannot switch it off. |
| **Protected paths** | A path the OS itself refuses the agent, rather than a rule matched against the words in a tool call. |
Every decision lands in `~/.solongate/local-logs/solongate-audit.jsonl`, owner
only, one JSON object per line.
## Protected paths
Every layer above reads the strings in a tool call. That stops `rm game.c`. It
does not stop a script the agent writes and then runs, a path assembled at
runtime, or a program the agent compiles that calls `unlink` itself, and no
amount of pattern-adding closes that: the ways to name a file without typing
its name do not run out.
So a protected path is handed to the operating system.
 [code] 
`protect` puts a permanent lock on the file: `chflags uchg` on macOS, an
`icacls` deny plus an OWNER_RIGHTS ACE on Windows, `chattr +i` on Linux. The
first two need no privilege. Linux has no unprivileged equivalent, so it asks
for one `sudo chattr +i`, shows the exact command first, and falls back to
`chmod 0444` if you decline. That fallback stops the write and does not stop
`rm`, and `protect list` says so rather than printing the word "pr