Free Guardrails & Safety
As of September 2026, AIDiveForge tracks 18 free guardrails & safety. The top three by verified-data score are Fabraix Red Team Playground, Panguard.AI, and ASL V6. Curated free guardrails & safety tracked by AIDiveForge. Each tool listed is currently free. Listings are verified against each tool's live website and re-checked regularly.
Last updated September 2, 2026 · 18 tools
Ranked by AIDiveForge's verified-data score: data completeness, verification recency, community rating, and real visitor engagement. How we rank · No tool can pay for placement.
1. Fabraix Red Team Playground
Fabraix Red Team Playground is an open-source, MIT-licensed testing environment structured around CTF-style challenges that let you probe published agent prompts for prompt injection vulnerabilities and guardrail failures. The workflow is concrete: challenges present a live agent prompt, you craft adversarial inputs, and the platform scores whether your attack broke containment. Self-hosting via npm means your proprietary prompts never leave your environment, which matters when the thing you are testing is a production system prompt you cannot share publicly. The challenge library is community-contributed and public, so coverage depends entirely on what the research community has submitted — niche agent architectures with specialized guardrail logic will find thin coverage fast.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
2. Panguard.AI
Panguard installs in one command, runs entirely offline with zero telemetry, and auto-detects agents across a wide surface — Claude Code, Cursor, VS Code Copilot, Gemini CLI, and more. The vendor states 768 ATR (Agent Threat Rules) execute locally as deterministic checks before any skill loads, then continue guarding each action at runtime against prompt injection and poisoned MCP tools. Rules contributed anywhere benefit every adopter — the vendor describes this as 'threat crystallization.' The ceiling appears when a threat is genuinely novel: deterministic rules only catch what someone has already seen and codified, so the AI analysis fallback carries the weight for zero-day patterns. Teams with regulated environments get signed, audit-ready output without routing data to a third party.
FreeOpen SourceSelf-hostedVerified Jul 20, 2026
3. ASL V6
ASL V6 combines AST-based static analysis with Docker-isolated runtime verification to find and confirm exploitable vulnerabilities in AI agent frameworks before they ship. The dual-layer approach means a finding isn't just flagged — it's verified in a sandboxed execution environment, which cuts the false-positive rate that burns security team time. It runs entirely offline with no external API calls, so sensitive proprietary code never leaves your machine. The ceiling appears quickly on non-Python codebases and on teams that need ticketing integrations or cloud-native CI pipelines baked in rather than assembled by hand.
FreeOpen SourceSelf-hostedVerified Jul 28, 2026
4. OpenTrust
OpenTrust runs in the browser, gathers signals about the environment and interaction patterns, and returns a trust score your server can act on. It fits teams that want a first-pass human-presence check layered on top of existing auth — not a replacement for it. The SDK is open-source and self-hostable, so the signal pipeline stays off third-party servers. The ceiling appears when you need decisioning logic, model retraining on your own fraud data, or server-side verification depth — none of that ships in the box. Teams with those needs wire OpenTrust as one input into a broader risk engine they build and maintain separately.
FreeOpen SourceAPISelf-hostedVerified Jul 24, 2026
5. Value System Kernel
The repo describes a blueprint for accelerator-native guardrail logic: input vectors are geometrically verified against pre-loaded danger references using IEEE 754 bit-masking and native FMA intrinsics, with the explicit goal of eliminating branch misprediction and warp divergence that stall GPU pipelines. V1 and V2 architectures are both present, with V2 repositioning the scan space as a multi-dimensional physical memory address structure rather than a semantic parsing layer. The vendor states this is a concept-proof blueprint, not a production-ready drop-in — teams expecting a plug-and-play safety layer will need to adapt the kernel to their inference stack. Community activity is minimal: zero forks, one star at the time of listing.
FreeOpen SourceSelf-hostedVerified Jul 13, 2026
6. ModelFuzz
The library ships two halves: a red-team scanner that fires deceptive prompt-injection payloads at any OpenAI-compatible endpoint so you can see which attacks actually trigger a tool call, and a decorator that wraps individual tools and checks every argument against your policies before the function executes. The decorator approach means enforcement lives in your code, not in a separate proxy or prompt. The policy engine works on argument content — keyword matching and pattern rules the docs describe — which catches known-bad patterns well but leaves gaps for novel exfiltration routes that do not match existing rules. A hosted dashboard with centralized policies and audit logs is on a waitlist and not yet available, so teams running multiple agents coordinate policy changes manually across codebases.
FreeOpen SourceSelf-hostedVerified Jul 28, 2026
7. QuantmLayer
QuantmLayer installs as a single static binary and builds a least-privilege cell from Linux kernel primitives — six enforced walls covering the filesystem, network egress, exec allowlisting, and audit. Credentials don't appear inside the cell as 'permission denied' — they don't exist at all. Egress is default-deny; nothing phones home unless a profile explicitly allows it. Every run commits its governing policy to a hash chain, so you can prove after the fact what the agent was and wasn't allowed to do. The MCP gateway adds a JSON-RPC-layer check so tool-server calls are validated against the server's own schema before they ever execute.
FreeOpen SourceSelf-hostedVerified Jul 22, 2026
8. Rampart
Rampart runs a two-layer pipeline entirely in the browser: a 14.7 MB ONNX token-classification model from Hugging Face combined with a deterministic recognizer layer that catches what the model misses. Nothing leaves the client unredacted — the architecture makes server-side PII exposure structurally impossible, not just policy-dependent. The npm package ships as a complete, reproducible artifact, so your redaction behavior is auditable and consistent across builds. The ceiling arrives when your entity types fall outside what the bundled model was trained to recognize — at that point you are retraining or replacing the model, not tweaking a config. Teams needing real-time redaction across high-volume server-side pipelines will hit the browser-only constraint immediately.
FreeOpen SourceSelf-hostedVerified Jul 11, 2026
9. Stonefold
Stonefold intercepts each action an agent tries to take, checks it against rules your team wrote and approved, routes sensitive ones to a named person for sign-off, and writes every attempt to an audit record — regardless of outcome. The vendor's own test is the clearest argument for it: a cheap model fell for a planted fraud email twelve out of twelve times, while an expensive model caught it every time, but with Stonefold's bank-detail rule in place, neither model let money reach the attacker. The checkpoint lives outside the model, so swapping models doesn't change your exposure. The project is at specification v0.4 and explicitly described as a working prototype — not a hardened production system.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
10. Argot
Argot runs statistical checks against your repository's own commit history to flag code that looks foreign to the codebase — wrong libraries, reversed import direction, misplaced logic, or tests quietly skipped to cover up a failing change. It checks a diff in roughly 200ms with no network call and no second LLM in the loop. The vendor reports 97.3% of foreign patterns caught against a 0.25% false-positive rate on real edits. The ceiling is detection scope: it surfaces what statistically doesn't fit, but it cannot enforce rules that have never appeared in your history. Repos with sparse or inconsistent histories get weaker signals.
FreeOpen SourceSelf-hostedVerified Aug 14, 2026
11. ButterClaw
ButterClaw runs as a self-hosted security monitor for AI agent deployments, watching post-authorization behavior for prompt injection attempts, credential exfiltration, and policy violations in real time. When it detects a breach condition, it can automatically revoke OAuth tokens and shred local credentials without waiting for a human to intervene. All of this runs locally — no cloud telemetry, no outbound data — which matters when the agents themselves are handling sensitive credentials. The Apache 2.0 license and Docker deployment model mean you own the stack entirely. The trade-off: without a vendor-hosted control plane, your team carries the operational weight of tuning and maintaining policies.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
12. Vultrino
Vultrino runs as a self-hosted credential proxy: agents reference an alias like 'github', and Vultrino injects the real token server-side, scrubs it from egress, and enforces a policy layer that decides whether the request is allowed at all. The agent never sees the key. AES-256-GCM encryption with Argon2 key derivation protects credentials at rest, so a stolen storage file doesn't yield anything readable without the master password. WASM plugins extend the model to PGP signing, SSH authentication, and crypto wallet transaction signing — credential types most proxy tools don't touch. The policy engine lets you scope each agent to specific URL patterns and HTTP methods, so a compromised agent role can't pivot beyond what it was granted.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
13. AGEF
The specification defines a content-addressed, Merkle-linked event structure so every decision in an agent session can be hashed, bundled, and checked offline — no live service required. The reference implementation is Akmon (v2.0.0 and later), which handles bundle export, import, and journaling via akmon-journal. AGEF is a format standard, not a deployed platform: there is no SaaS, no API, and no hosted verification service. Teams adopting it are taking on the work of building or integrating bundle-producing substrates into their existing agent infrastructure. At v0.1.1, the spec is pre-stable — conformance profiles and bundle structure are defined, but tooling outside the Akmon reference implementation is essentially absent.
FreeOpen SourceSelf-hostedVerified Jun 1, 2026
14. Agent Governance Toolkit
Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents.
FreeOpen SourceAPISelf-hostedVerified May 1, 2026
15. Agent Passport
Agent Passport is an open-source authorization layer that sits between your agents and the actions they take. You issue a scoped passport — specific permissions, a spend cap, a time window — then every action checks against it before executing. Denied calls are logged alongside allowed ones, so you have a record either way. Delegation chains shrink permissions as they pass down to sub-agents; a child passport cannot exceed what the parent granted. Revocation cascades instantly across the whole chain, so you're not hunting down API keys across six services.
FreeOpen SourceAPISelf-hostedVerified Jul 1, 2026
16. PII GUI
The app runs detection locally using on-device models, so nothing is uploaded at any point — no sign-up, no server round-trip, no cloud dependency. You review every flagged item in context before committing to a redaction, which means you catch the false positives before they become permanent holes in a legal document. Custom regex lets you add patterns the model won't know: internal case IDs, account number formats, bespoke identifiers. The export produces a PDF with sensitive text actually gone, not layered over. Where it breaks: single-file, single-session workflow with no batch processing described in the docs, so teams processing hundreds of support logs daily will hit a throughput ceiling fast.
FreeOpen SourceSelf-hostedVerified Jun 21, 2026
17. RiskKernel
Deployed as a single Go binary, it sits in front of your existing OpenAI, Anthropic, or LangChain stack via a one-variable proxy — no rewrite required. Every call is metered and checkpointed, so a killed or crashed run resumes from the last saved state instead of re-spending from zero. The human-approval gate routes irreversible tool calls for sign-off over CLI, web, or webhook before they fire, and the LLM cannot bypass it because the gate lives in compiled code, not a prompt. The hosted dashboard is private beta only; teams that need a UI today are self-managing.
FreeOpen SourceAPISelf-hostedVerified Jun 12, 2026
18. Trajeckt
The tool sits as a runtime gateway between your agent and its tools, evaluating the sequence of calls rather than any individual call in isolation. The vendor states enforcement runs deterministically in approximately 1.6ms, outside the model itself, so policy decisions cannot be overridden by prompt injection. It is open-source under Apache-2.0 and self-hostable via Docker or Cargo. Where it fits well is MCP-compatible setups that need sequence-level rules without building a custom policy engine. Where it breaks is anywhere you need probabilistic or context-aware rules — this is deterministic enforcement, and the constraints you do not define ahead of time do not get caught.
FreeOpen SourceAPISelf-hostedVerified Jul 1, 2026
Listings on this page are sourced and verified by the AIDiveForge data pipeline. AIDiveForge is editorially independent — inclusion and rank are not for sale. Labeled ads are separate.