Fabraix Red Team Playground
Free · Open source
AI security researchers
Stonefold
FreeOpen SourceAPISelf-Hosted
Your agent has full database credentials and an invoice mailbox — and the only thing standing between it and a fraudulent wire transfer is whether the model happens to notice the email looked wrong. Stonefold puts a checkpoint between the agent and every action it attempts, so the model's judgment stops being the last line of defense.
Similar tools
Fabraix Red Team PlaygroundFreeFabraix Red Team Playground is an open-source, MIT-licensed testing environment structured…
EclusiaFreemiumEclusia runs locally on your machine and replaces names, IBANs, phone numbers, API keys, and…
Patronus ScannerFreemiumPatronus AI positions itself as evaluation and monitoring infrastructure for production LLM…
ArgotFreeArgot runs statistical checks against your repository's own commit history to flag code that…
Get This Tool
License: Apache-2.0 Any use incl. commercial
Local-run terms: Reference implementation available; full commercial use permitted under Apache-2.0
Pricing
- Model
- Free
Summary
Stonefold intercepts each action an agent tries to take, checks it against rules your team wrote and approved, routes sensitive ones to a named person for sign-off, and writes every attempt to an audit record — regardless of outcome. The vendor's own test is the clearest argument for it: a cheap model fell for a planted fraud email twelve out of twelve times, while an expensive model caught it every time, but with Stonefold's bank-detail rule in place, neither model let money reach the attacker. The checkpoint lives outside the model, so swapping models doesn't change your exposure. The project is at specification v0.4 and explicitly described as a working prototype — not a hardened production system.
Bottom line: Pick Stonefold when you need an auditable paper trail showing that a human reviewed and signed off on the policies governing what your agents can touch; plan for significant integration engineering if your agent stack doesn't already expose discrete action calls you can wrap.
Find your fit
Before you choose Stonefold
More options in Guardrails & Safety. Compare pricing, platforms, and features side by side.
Eclusia
Freemium
Legal professionals handling confidential cases
Pros
- Policy enforcement lives outside the model, which means swapping the underlying LLM — for cost, capability, or availability — doesn't change what actions are allowed or blocked, so your safety guarantees don't reset every time a new model ships.
- Every action attempt, allowed or denied, writes an audit record, so compliance reviews have a named decision trace rather than log files you have to reconstruct after an incident.
- Bank-detail changes, database deletions, and similarly high-stakes actions route to a named human for sign-off before executing, which means a single misconfigured agent or a prompt injection attack cannot complete a destructive action unilaterally.
- Apache 2.0 license with a self-hosted deployment path, so the checkpoint and its audit records stay inside your infrastructure and never transit a third-party managed service.
- Rules are expressed as explicit policy that a person reads and approves, which shifts the accountability question from 'did the AI behave?' — unanswerable — to 'did this action match the policy?' — auditable.
Cons
- The project is at specification v0.4 and vendor-described as a working prototype: teams building on it in production are building on pre-stable APIs, and breaking changes between specification versions carry no documented migration support — meaning your integration engineer owns that risk.
- Stonefold intercepts discrete action calls, which requires your agent to expose its actions as individual, interceptable steps; agents that execute through opaque tool chains or frameworks that batch actions internally need architectural changes before the checkpoint can inspect anything meaningful, and that refactor can cost more than the integration itself.
- There is no managed hosted offering, no paid support tier, and no documented SLA — teams that hit an edge case in the checkpoint logic are filing a GitHub issue and waiting, which is the point at which teams with compliance deadlines move to a commercial policy-enforcement vendor with a support contract.
About
- Platforms
- Python
- API Available
- Yes
- Self-Hosted
- Yes
- Last Updated
- August 14, 2026
Best For
Who it's for
- Teams running agents with real system access
- Environments requiring explicit policy review over model trust
- Auditable agent deployments with named approvers
What it does well
- Enforce payment approval workflows with human sign-off on bank-detail changes
- Audit all agent actions against clinical worklist rules
- Block or hold cloud infrastructure changes like database deletions
- Record every attempt for compliance review
Frequently Asked Questions
- Is Stonefold free?
- Stonefold offers a free option. Hosting, model usage, or optional services may have separate costs; check the pricing details and official terms.
- Is Stonefold open source?
- Yes. Stonefold is open source.
- Does Stonefold have an API?
- Yes. Stonefold exposes a developer API. See the official documentation at https://stonefold.ai for details.
- Can I self-host Stonefold?
- Yes. Stonefold supports self-hosting on your own infrastructure.
- What platforms does Stonefold support?
- Stonefold is available on: Python.
Curated lists that include this category
When an agent’s credentials outrun its judgment
Your agent has full database credentials and an invoice mailbox — and the only thing standing between it and a fraudulent wire transfer is whether the model happens to notice the email looked wrong. Stonefold puts a checkpoint between the agent and every action it attempts.
Stonefold intercepts each action an agent tries to take, checks it against rules your team wrote and approved, routes sensitive ones to a named person for sign-off, and writes every attempt to an audit record regardless of outcome. The vendor states that in their test a cheap model fell for a planted fraud email twelve out of twelve times while an expensive model caught it every time, yet with Stonefold’s bank-detail rule in place neither model let money reach the attacker. The checkpoint lives outside the model so swapping models does not change exposure. It is free, ships as a Python package, offers an API, and supports self-hosting.
Use cases the docs describe
Enforce payment approval workflows with human sign-off on bank-detail changes. Audit all agent actions against clinical worklist rules. Block or hold cloud infrastructure changes like database deletions. Record every attempt for compliance review.
Pros and trade-offs
Policy enforcement lives outside the model, which means swapping the underlying LLM does not change what actions are allowed or blocked. Every action attempt writes an audit record so compliance reviews have a named decision trace. High-stakes actions route to a named human for sign-off before executing. The project is at specification v0.4 and described as a working prototype; teams using it in production accept pre-stable APIs and carry the risk of breaking changes without documented migration support. It also requires agents to expose actions as individual interceptable steps.
Who it is for / who should skip it
Best for teams running agents with real system access in environments that need explicit policy review over model trust and auditable deployments with named approvers. Skip it if your agents run through opaque tool chains or if you require stable production APIs today.
Contribute
- Work on Stonefold? Claim this listing.
- Embed a badge for your README or site.
Sign in to rate this tool or suggest an edit.