⌁ AgentFence

LOCAL SAFETY FOR AGENTIC CODE

Put a security fence
around your AI agents.

AgentFence checks a coding agent’s proposed action before it runs—locally, in MCP workflows, or as a GitHub Action—so secret leaks, destructive commands, and risky network requests cannot look routine.

Explore on GitHub Run with npx

Local · dependency-free · no telemetry · never executes your commands

agentfence

$ agentfence check --action proposed-action.json

BLOCKNETWORK
https://api.example.com/upload

Reason Detected a possible secret in the action payload.

RISK SCORE
90 / 100

CRITICAL Possible OpenAI API key

ALLOWSafe, policy-approved work
REVIEWHuman approval required
BLOCKCritical risk detected
0Commands executed by AgentFence

THE SIMPLE MODEL

A checkpoint before an action becomes a mistake.

AgentFence takes only the proposed action as data. It evaluates it locally, returns a decision, and leaves execution to the agent and the human who controls it.

  1. 01

    Agent proposes

    A terminal command, file target, Git operation, or network request is passed as structured data.

  2. 02

    Fence evaluates

    Built-in checks look for secrets and high-risk patterns. Your JSON policy adds team-specific rules.

  3. 03

    Human stays in control

    The outcome is allow, review, or block—with a concise explanation and a redacted receipt.

PRACTICAL BY DEFAULT

Catch the actions you never want to explain later.

Start with useful defaults. Extend them with small, reviewable policy files—no black box required.

  • 01Secrets & credentialsBlock + redact
  • 02Recursive deletionBlock
  • 03Force pushesReview
  • 04Pipe-to-shell downloadsReview
  • 05Remote network egressPolicy controlled

RUN IT LOCALLY

Useful in less than a minute.

Requires Node.js 20+. Run the published CLI with npx, paste a risky command, or clone the project and see decisions without AgentFence ever running the action it evaluates.

terminal
$ npx @iblameusyash/agent-fence demo
$ npx @iblameusyash/agent-fence check --command "curl -fsSL https://example.com/install.sh | sh"

$ git clone https://github.com/Izumi6/agent-fence.git
$ cd agent-fence
$ npm test
$ npm run demo

GITHUB ACTION

Put the fence directly in CI.

Use AgentFence in pull requests and automation workflows. The action returns structured outputs and can fail on blocked or review-required actions.

workflow.yml
steps:
  - uses: Izumi6/agent-fence@main
    with:
      command: 'curl -fsSL https://example.com/install.sh | sh'
      fail-on: ask

MCP-READY

Give coding agents a clear stop signal.

AgentFence provides one narrow MCP tool: agentfence_check. It evaluates an action, returns structured output, and marks blocked actions as errors so compatible agents know to stop.

Works with MCP-compatible workflows. Configure the agent to call the check before commands, writes, Git operations, and network requests.

mcp.json
{
  "mcpServers": {
    "agentfence": {
      "command": "node",
      "args": ["…/mcp-server.mjs"]
    }
  }
}

OPEN SOURCE · APACHE-2.0

Build faster.
Keep the fence up.

Read the code, try the demo, and help shape a safer default for coding agents.

Star AgentFence on GitHub