solongate/agent-security: Local-first, open-source security gateway for AI coding agents. Enforce tool-call policies, detect secrets, and audit actions on-device.

SolonGate Agent Security. Open-source security for AI agent actions.

_{Security Badges}

SolonGate Agent Security is SolonGate's open source, local first security gateway for AI coding agents. It checks tool calls against your policies before they run, with secret detection, rate limits and a local audit trail.

This repository is the Agent Security gateway. The rest of the portfolio is at solongate.com.

Everything stays on the machine. The policy is a file, the audit trail is a file, and the guard makes no network calls. No account, no telemetry.

A tool call from an AI agent passes through SolonGate, which runs a policy check, DLP scan, rate limit and logging, then allows or blocks it before the tool runs

Install and use

Requires git to clone this repo. Go 1.26+ is needed too; install.sh downloads the official go.dev build for you if it is not already there, regardless of OS.

git clone https://github.com/solongate/agent-security.git
cd agent-security
./scripts/install.sh
solongate

Then open a new terminal. Hooks load when a session starts, so an already open one is not guarded yet.

What it looks like when it fires

A real Claude Code session: the agent reaches for a .env, the guard refuses it, and the agent says so rather than quietly working around it.

A Claude Code session in which SolonGate blocks access to a .env file and Claude reports the refusal instead of working around it

What it does

| Layer | What it does | | --- | --- | | Policy rules | Allow or deny by path, command, filename or URL, scoped to READ, WRITE, EXECUTE or NETWORK. | | DLP | 70+ built in secret patterns plus your own, in four modes: off, detect, redact, block. | | Egress | In block mode, refuses an upload whose file holds a secret, which pattern matching on the call alone cannot see. | | Rate limits | A cap per minute, hour or day. | | The prompt | A shim masks the outbound request body on Claude Code, which no tool call hook can reach. | | Tamper protection | The guard's own state is unreachable from a tool call, and a policy in a repository cannot switch it off. | | Protected paths | A path the OS itself refuses the agent, rather than a rule matched against the words in a tool call. | | Sandbox | The agent's whole root is a new, minimal filesystem holding only the project; everything else is not refused, it is not there. |

The CLI

solongate                        the TUI: policies, audit, settings
solongate policy                 list, create and edit the policy
solongate dlp                    secret detection
solongate ratelimit              the rate limit
solongate policy protect <path>  lock a path, and say what the lock is worth
solongate policy protect list    what is actually holding each path, read from disk
solongate sandbox list           the boxes this machine has, and their ids
solongate sandbox 001 claude     start the agent inside box 001
solongate sandbox --explain 001  everything that is in that box
solongate run claude             start an agent with protected paths out of reach
solongate audit                  browse the audit trail
solongate watch                  live tail tool calls
solongate trace                  what the guard saw in this directory
solongate doctor                 health check
solongate repair                 restore the guard, hooks and settings
solongate update                 pull the newest version and reinstall
solongate range                  how far an update is allowed to move
solongate range short            every commit on the branch
solongate range long             tagged releases only, reliable (the default)

Supported agents

Contributors ✨

Thanks to these wonderful people. Without their help, this project would not have made it this far.

_codeyevsky 💻	_{Emirhan Demir} 💻	_tnalbant 💻	_Sahil 💻	_Sleep8h 💻	_{Nikita Dereglazov} 💻	_Oscar 💻
_{Liu XingJian} 💻	_Hamza 💻	_zgy 💻	_Asish 💻	_{Stephen Cork} 💻