Agent Passport vs RiskKernel

Agent Passport and RiskKernel are both guardrails & safety tracked by AIDiveForge. Below is a side-by-side comparison of pricing, capabilities, platforms, and ownership — sourced from each tool's live website and verified before publishing.

Agent Passport

Agent Passport is an open-source authorization layer that sits between your agents and the actions they take. You issue a scoped passport — specific permissions, a spend cap, a time window — then every action checks against it before executing. Denied calls are logged alongside allowed ones, so you have a record either way. Delegation chains shrink permissions as they pass down to sub-agents; a child passport cannot exceed what the parent granted. Revocation cascades instantly across the whole chain, so you're not hunting down API keys across six services.

RiskKernel

Deployed as a single Go binary, it sits in front of your existing OpenAI, Anthropic, or LangChain stack via a one-variable proxy — no rewrite required. Every call is metered and checkpointed, so a killed or crashed run resumes from the last saved state instead of re-spending from zero. The human-approval gate routes irreversible tool calls for sign-off over CLI, web, or webhook before they fire, and the LLM cannot bypass it because the gate lives in compiled code, not a prompt. The hosted dashboard is private beta only; teams that need a UI today are self-managing.

Attribute	Agent Passport	RiskKernel
Pricing	Free	Free
Free trial	No	No
Open source	Yes	Yes
Has API	Yes	Yes
Self-hosted option	Yes	Yes
Platforms	Node.js, self-hosted	Linux, macOS, Windows (Go binary)
Pros	Scoped permissions per agent per task, so a booking bot that needs calendar access cannot also charge a payment method — even if the underlying account credentials would allow it. Server-side spend tracking with hard caps, which means agents cannot silently drain API budgets between monitoring checks — the deny fires at the limit, not after the bill arrives. Instant cascade revocation across delegation chains, so cutting off a parent passport stops all child agents immediately without rotating keys across every downstream integration. Every authorize() call is logged whether allowed or denied, so when an auditor asks what your agent attempted at 14:23:08, you have a signed record — not a gap. Purpose-built packages for LangChain, CrewAI, Express, Fastify, and MCP, so wrapping existing agent tools does not require rewriting call patterns from scratch.	Hard per-run dollar and token ceilings enforced in compiled code, which means the kill switch fires before the overspend registers rather than after the invoice cycle closes. Crash-resumable checkpointing, so a process killed mid-run restarts from the last saved state instead of replaying every prior API call and paying for them again. Human-approval gate for side-effecting tool calls that the LLM cannot route around, so irreversible actions — deleting records, sending messages, writing to external systems — wait for a human decision before executing. One-variable proxy adoption with no code rewrite required, so existing agents running against OpenAI or Anthropic get metering and enforcement without refactoring the application. Self-hosted Apache 2.0 binary with BYO provider keys and no telemetry, so teams in regulated or air-gapped environments get full auditability without exporting run data to a third-party service.
Cons	The audit store is SQLite. A single-file database works for a single server and moderate throughput — teams running multiple agent instances or high-frequency authorize() calls will hit write contention and need to either replace the persistence layer or front it with a queue, at which point they are maintaining infrastructure the tool does not provide. There is no managed cloud option; every component is self-hosted. Teams that need a SOC 2-audited, access-controlled audit log with role-based visibility into the dashboard will build that controls layer themselves — and teams whose security policy prohibits self-managed audit storage will move to a vendor that offers it. Delegation only constrains permissions downward — it does not add them. If your agent graph needs a sub-agent to acquire permissions the parent was not issued, you reissue from the top, which means any workflow that dynamically expands scope mid-run requires a round-trip to the issuing authority rather than a local escalation path.	The hosted dashboard is private beta only, so teams that need a web UI to monitor, review, or manage runs across agents have no production-ready option yet — they operate through CLI or build their own view against the OpenTelemetry export. SDK adapters are scoped to LangChain, the Claude Agent SDK, and the OpenAI Agents SDK; teams running CrewAI, AutoGen, or any other framework hit the proxy layer only and lose loop-count and tool-level controls until they write their own adapter. The project is maintained by a single developer with no enterprise support tier listed; teams whose compliance posture requires a support contract or SLA will find nothing on offer and will move to a vendor-backed observability or guardrails product instead.

Bottom line

Agent Passport and RiskKernel are closely matched on pricing model, openness, and API availability — pick by feature set and platform support in the table above.

Frequently asked questions

What is the difference between Agent Passport and RiskKernel?

Agent Passport is Free and open source, while RiskKernel is Free and open source. Compare pricing, free trial, API, platforms, and pros/cons in the table above on AIDiveForge.

Is Agent Passport better than RiskKernel?

It depends on your workflow. Use the side-by-side attributes (pricing, open source, API, self-hosted, platforms) to decide. AIDiveForge does not rank a universal winner — we publish verified facts so you can choose.