Open Source Guardrails & Safety
As of September 2026, AIDiveForge tracks 24 open source guardrails & safety. The top three by verified-data score are Fabraix Red Team Playground, Panguard.AI, and NeuralTrust TrustGate. Curated open source guardrails & safety tracked by AIDiveForge. Each project has a verified public source repository. Listings are verified against each tool's live website and re-checked regularly.
Last updated September 2, 2026 · 24 tools
Ranked by AIDiveForge's verified-data score: data completeness, verification recency, community rating, and real visitor engagement. How we rank · No tool can pay for placement.
1. Fabraix Red Team Playground
Fabraix Red Team Playground is an open-source, MIT-licensed testing environment structured around CTF-style challenges that let you probe published agent prompts for prompt injection vulnerabilities and guardrail failures. The workflow is concrete: challenges present a live agent prompt, you craft adversarial inputs, and the platform scores whether your attack broke containment. Self-hosting via npm means your proprietary prompts never leave your environment, which matters when the thing you are testing is a production system prompt you cannot share publicly. The challenge library is community-contributed and public, so coverage depends entirely on what the research community has submitted — niche agent architectures with specialized guardrail logic will find thin coverage fast.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
2. Panguard.AI
Panguard installs in one command, runs entirely offline with zero telemetry, and auto-detects agents across a wide surface — Claude Code, Cursor, VS Code Copilot, Gemini CLI, and more. The vendor states 768 ATR (Agent Threat Rules) execute locally as deterministic checks before any skill loads, then continue guarding each action at runtime against prompt injection and poisoned MCP tools. Rules contributed anywhere benefit every adopter — the vendor describes this as 'threat crystallization.' The ceiling appears when a threat is genuinely novel: deterministic rules only catch what someone has already seen and codified, so the AI analysis fallback carries the weight for zero-day patterns. Teams with regulated environments get signed, audit-ready output without routing data to a third party.
FreeOpen SourceSelf-hostedVerified Jul 20, 2026
3. NeuralTrust TrustGate
NeuralTrust TrustGate sits between your agents and the models, tools, and services they reach, enforcing policy at the interaction level rather than bolting controls on after the fact. The vendor states the gateway handles real-time enforcement at sub-100ms latency and claims behavioral, contextual, and multilingual detection across 22 million-plus AI interactions analyzed. Self-hosted deployment via on-prem or VPC keeps data inside your perimeter — a hard requirement in regulated industries where data leaving the environment ends the conversation. The open-source core is Apache-2.0 licensed, which means your security team can audit what is actually running. Enterprise features, SIEM integration, and dedicated support are paid-only.
PaidOpen SourceAPISelf-hostedVerified Aug 14, 2026
4. Strix
Strix runs multi-agent Think-Plan-Act loops that scan infrastructure, attempt exploitation, and return findings backed by working PoCs — so your team reviews confirmed vulnerabilities rather than triaging noise. The vendor page describes CI/CD integration and PR-level fix suggestions, which means security gates can live inside the same pipeline where code ships. Self-hosted and air-gapped deployment options are confirmed, making it viable for teams with data residency requirements. The agentic model works well when scope is defined and targets are enumerable — cloud misconfigs, known CVE classes, API surface. Where it strains is against novel logic flaws and business-layer vulnerabilities that require context no automated agent carries.
PaidOpen SourceSelf-hostedVerified Jul 14, 2026
5. ASL V6
ASL V6 combines AST-based static analysis with Docker-isolated runtime verification to find and confirm exploitable vulnerabilities in AI agent frameworks before they ship. The dual-layer approach means a finding isn't just flagged — it's verified in a sandboxed execution environment, which cuts the false-positive rate that burns security team time. It runs entirely offline with no external API calls, so sensitive proprietary code never leaves your machine. The ceiling appears quickly on non-Python codebases and on teams that need ticketing integrations or cloud-native CI pipelines baked in rather than assembled by hand.
FreeOpen SourceSelf-hostedVerified Jul 28, 2026
6. OpenTrust
OpenTrust runs in the browser, gathers signals about the environment and interaction patterns, and returns a trust score your server can act on. It fits teams that want a first-pass human-presence check layered on top of existing auth — not a replacement for it. The SDK is open-source and self-hostable, so the signal pipeline stays off third-party servers. The ceiling appears when you need decisioning logic, model retraining on your own fraud data, or server-side verification depth — none of that ships in the box. Teams with those needs wire OpenTrust as one input into a broader risk engine they build and maintain separately.
FreeOpen SourceAPISelf-hostedVerified Jul 24, 2026
7. Value System Kernel
The repo describes a blueprint for accelerator-native guardrail logic: input vectors are geometrically verified against pre-loaded danger references using IEEE 754 bit-masking and native FMA intrinsics, with the explicit goal of eliminating branch misprediction and warp divergence that stall GPU pipelines. V1 and V2 architectures are both present, with V2 repositioning the scan space as a multi-dimensional physical memory address structure rather than a semantic parsing layer. The vendor states this is a concept-proof blueprint, not a production-ready drop-in — teams expecting a plug-and-play safety layer will need to adapt the kernel to their inference stack. Community activity is minimal: zero forks, one star at the time of listing.
FreeOpen SourceSelf-hostedVerified Jul 13, 2026
8. ModelFuzz
The library ships two halves: a red-team scanner that fires deceptive prompt-injection payloads at any OpenAI-compatible endpoint so you can see which attacks actually trigger a tool call, and a decorator that wraps individual tools and checks every argument against your policies before the function executes. The decorator approach means enforcement lives in your code, not in a separate proxy or prompt. The policy engine works on argument content — keyword matching and pattern rules the docs describe — which catches known-bad patterns well but leaves gaps for novel exfiltration routes that do not match existing rules. A hosted dashboard with centralized policies and audit logs is on a waitlist and not yet available, so teams running multiple agents coordinate policy changes manually across codebases.
FreeOpen SourceSelf-hostedVerified Jul 28, 2026
9. QuantmLayer
QuantmLayer installs as a single static binary and builds a least-privilege cell from Linux kernel primitives — six enforced walls covering the filesystem, network egress, exec allowlisting, and audit. Credentials don't appear inside the cell as 'permission denied' — they don't exist at all. Egress is default-deny; nothing phones home unless a profile explicitly allows it. Every run commits its governing policy to a hash chain, so you can prove after the fact what the agent was and wasn't allowed to do. The MCP gateway adds a JSON-RPC-layer check so tool-server calls are validated against the server's own schema before they ever execute.
FreeOpen SourceSelf-hostedVerified Jul 22, 2026
10. Rampart
Rampart runs a two-layer pipeline entirely in the browser: a 14.7 MB ONNX token-classification model from Hugging Face combined with a deterministic recognizer layer that catches what the model misses. Nothing leaves the client unredacted — the architecture makes server-side PII exposure structurally impossible, not just policy-dependent. The npm package ships as a complete, reproducible artifact, so your redaction behavior is auditable and consistent across builds. The ceiling arrives when your entity types fall outside what the bundled model was trained to recognize — at that point you are retraining or replacing the model, not tweaking a config. Teams needing real-time redaction across high-volume server-side pipelines will hit the browser-only constraint immediately.
FreeOpen SourceSelf-hostedVerified Jul 11, 2026
11. Stonefold
Stonefold intercepts each action an agent tries to take, checks it against rules your team wrote and approved, routes sensitive ones to a named person for sign-off, and writes every attempt to an audit record — regardless of outcome. The vendor's own test is the clearest argument for it: a cheap model fell for a planted fraud email twelve out of twelve times, while an expensive model caught it every time, but with Stonefold's bank-detail rule in place, neither model let money reach the attacker. The checkpoint lives outside the model, so swapping models doesn't change your exposure. The project is at specification v0.4 and explicitly described as a working prototype — not a hardened production system.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
12. Argot
Argot runs statistical checks against your repository's own commit history to flag code that looks foreign to the codebase — wrong libraries, reversed import direction, misplaced logic, or tests quietly skipped to cover up a failing change. It checks a diff in roughly 200ms with no network call and no second LLM in the loop. The vendor reports 97.3% of foreign patterns caught against a 0.25% false-positive rate on real edits. The ceiling is detection scope: it surfaces what statistically doesn't fit, but it cannot enforce rules that have never appeared in your history. Repos with sparse or inconsistent histories get weaker signals.
FreeOpen SourceSelf-hostedVerified Aug 14, 2026
13. ButterClaw
ButterClaw runs as a self-hosted security monitor for AI agent deployments, watching post-authorization behavior for prompt injection attempts, credential exfiltration, and policy violations in real time. When it detects a breach condition, it can automatically revoke OAuth tokens and shred local credentials without waiting for a human to intervene. All of this runs locally — no cloud telemetry, no outbound data — which matters when the agents themselves are handling sensitive credentials. The Apache 2.0 license and Docker deployment model mean you own the stack entirely. The trade-off: without a vendor-hosted control plane, your team carries the operational weight of tuning and maintaining policies.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
14. Legibility Field Kit
The kit is a zero-dependency Python CLI that runs three checks against your AI decision records: does every change name a specific human owner, is time-to-reverse recorded for reversible actions, and does each entry carry a complete OTW receipt — Owner, Time, Witness. Run `audit` against a directory of governance files and it surfaces every defect in seconds. The scoring command turns those findings into a maturity grade across the three tests, giving compliance teams a number to track sprint over sprint. The wall appears fast: the kit reads files, flags gaps, and stops — it does not integrate with your ticketing system, your CI pipeline, or your approval workflow.
PaidOpen SourceSelf-hostedVerified Jul 11, 2026
15. Vultrino
Vultrino runs as a self-hosted credential proxy: agents reference an alias like 'github', and Vultrino injects the real token server-side, scrubs it from egress, and enforces a policy layer that decides whether the request is allowed at all. The agent never sees the key. AES-256-GCM encryption with Argon2 key derivation protects credentials at rest, so a stolen storage file doesn't yield anything readable without the master password. WASM plugins extend the model to PGP signing, SSH authentication, and crypto wallet transaction signing — credential types most proxy tools don't touch. The policy engine lets you scope each agent to specific URL patterns and HTTP methods, so a compromised agent role can't pivot beyond what it was granted.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
16. AGEF
The specification defines a content-addressed, Merkle-linked event structure so every decision in an agent session can be hashed, bundled, and checked offline — no live service required. The reference implementation is Akmon (v2.0.0 and later), which handles bundle export, import, and journaling via akmon-journal. AGEF is a format standard, not a deployed platform: there is no SaaS, no API, and no hosted verification service. Teams adopting it are taking on the work of building or integrating bundle-producing substrates into their existing agent infrastructure. At v0.1.1, the spec is pre-stable — conformance profiles and bundle structure are defined, but tooling outside the Akmon reference implementation is essentially absent.
FreeOpen SourceSelf-hostedVerified Jun 1, 2026
17. Agent Governance Toolkit
Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents.
FreeOpen SourceAPISelf-hostedVerified May 1, 2026
18. Agent Passport
Agent Passport is an open-source authorization layer that sits between your agents and the actions they take. You issue a scoped passport — specific permissions, a spend cap, a time window — then every action checks against it before executing. Denied calls are logged alongside allowed ones, so you have a record either way. Delegation chains shrink permissions as they pass down to sub-agents; a child passport cannot exceed what the parent granted. Revocation cascades instantly across the whole chain, so you're not hunting down API keys across six services.
FreeOpen SourceAPISelf-hostedVerified Jul 1, 2026
19. ComplyEdge
ComplyEdge is an open-source compliance engine that runs on every production request your AI agent processes, enforcing EU AI Act Article 5 prohibitions and emitting structured audit trails instead of opaque scores. The decorator-based Python SDK wraps agent entry points with a single annotation, so enforcement is tied to the code path rather than bolted on downstream. TrustLint, the companion CLI tool, moves the same rule set into CI/CD so violations surface before deployment. The ceiling appears when you need jurisdictions beyond EU or rule sets beyond Article 5 — the repo shows EU coverage, and teams with broader regulatory scope will find themselves extending the rule library themselves. With three GitHub stars and zero open issues at time of writing, production battle-testing is still accumulating.
PaidOpen SourceAPISelf-hostedVerified Jun 18, 2026
20. gate-oc-audit
Gate operates as a drop-in proxy: your agent points at one endpoint, Gate inspects every outbound prompt and every inbound response, then enforces the policy you write — blocking injections, redacting secrets and PII, flagging ambiguous cases, and writing every decision to a tamper-evident audit log anchored to a blockchain. The vendor reports 97.4% F1 across 16 public prompt-injection benchmarks and a head-to-head F1 of 96.6% versus Lakera Guard's 83.7% on four matched datasets; methodology and per-benchmark scores are published. Token compression and prefix caching run on every request, and the vendor states users see 20% or more token savings without changing model outputs. Gate is in private beta with no self-hosted deployment option, so teams with hard data-residency requirements hit a wall immediately.
PaidOpen SourceAPIVerified Jun 18, 2026
21. PII GUI
The app runs detection locally using on-device models, so nothing is uploaded at any point — no sign-up, no server round-trip, no cloud dependency. You review every flagged item in context before committing to a redaction, which means you catch the false positives before they become permanent holes in a legal document. Custom regex lets you add patterns the model won't know: internal case IDs, account number formats, bespoke identifiers. The export produces a PDF with sensitive text actually gone, not layered over. Where it breaks: single-file, single-session workflow with no batch processing described in the docs, so teams processing hundreds of support logs daily will hit a throughput ceiling fast.
FreeOpen SourceSelf-hostedVerified Jun 21, 2026
22. PreFlight
PreFlight installs via npm and runs as a pre-commit gate, scanning AI-generated code for security vulnerabilities in auth flows, database logic, and SQL patterns — then offering deterministic or AI-assisted patches inline. It integrates with VS Code, Cursor, and MCP clients, so the scan happens in the environment where the AI code was written. The free tier caps patches at ten, which is sufficient for evaluation but stops short of daily use on an active codebase. Teams that exceed that ceiling without a pro key lose the fix-application step and are left with scan output only. The repo is open-source and self-hosted, so the scan never phones home.
PaidOpen Source$19/moSelf-hostedVerified Jun 23, 2026
23. RiskKernel
Deployed as a single Go binary, it sits in front of your existing OpenAI, Anthropic, or LangChain stack via a one-variable proxy — no rewrite required. Every call is metered and checkpointed, so a killed or crashed run resumes from the last saved state instead of re-spending from zero. The human-approval gate routes irreversible tool calls for sign-off over CLI, web, or webhook before they fire, and the LLM cannot bypass it because the gate lives in compiled code, not a prompt. The hosted dashboard is private beta only; teams that need a UI today are self-managing.
FreeOpen SourceAPISelf-hostedVerified Jun 12, 2026
24. Trajeckt
The tool sits as a runtime gateway between your agent and its tools, evaluating the sequence of calls rather than any individual call in isolation. The vendor states enforcement runs deterministically in approximately 1.6ms, outside the model itself, so policy decisions cannot be overridden by prompt injection. It is open-source under Apache-2.0 and self-hostable via Docker or Cargo. Where it fits well is MCP-compatible setups that need sequence-level rules without building a custom policy engine. Where it breaks is anywhere you need probabilistic or context-aware rules — this is deterministic enforcement, and the constraints you do not define ahead of time do not get caught.
FreeOpen SourceAPISelf-hostedVerified Jul 1, 2026
Listings on this page are sourced and verified by the AIDiveForge data pipeline. AIDiveForge is editorially independent — inclusion and rank are not for sale. Labeled ads are separate.