AgentGuard is the open-source governance layer for teams running AI agents in production. Self-hosted, MCP-aware, audit-ready.
Observed package downloads from PyPI, updated hourly. Counts include mirror noise filtered out where the upstream supports it. Downloads are a usage signal, not an adoption proof. A conservative floor is shown when every upstream is unavailable.
Put hard budget, loop, timeout, and rate limits inside the agent code that spends money.
Create a read key, keep event history, and see the traces your team needs later.
Create read keyLet your coding agent ask AgentGuard for traces, alerts, usage, costs, and budget health.
Not sure what to guard?
Describe the workflow, tools, users, and expected usage. The Agent Roadmap Scanner returns likely runtime risks, first guardrails, and where AgentGuard fits.
Run the scannerMCP setup
The MCP server does not replace the Python SDK. The SDK stops bad runs. The MCP server lets your editor inspect retained traces, alerts, usage, costs, and budget health after you connect a read key from the dashboard.
{
"mcpServers": {
"agentguard": {
"command": "npx",
"args": ["-y", "@agentguard47/mcp-server"],
"env": {
"AGENTGUARD_API_KEY": "ag_your_read_key_here"
}
}
}
}{
"mcpServers": {
"agentguard": {
"command": "npx",
"args": ["-y", "@agentguard47/mcp-server"],
"env": {
"AGENTGUARD_API_KEY": "ag_your_read_key_here"
}
}
}
}Command
npx -y @agentguard47/mcp-server
Credential
Read-only ag_... API key
Tools
traces, alerts, usage, costs, budget health
Quickstart
AgentGuard is not magic middleware. You record usage where money or loops happen. When a limit trips, it raises an AgentGuardError with the reason.
PyPI package name is agentguard47.
Run the doctor before wiring your real agent.
agentguard doctor --json
Budget, loop, timeout, and rate guards raise before the run keeps spending.
except AgentGuardError as exc:
print(f"stopped: {exc}")from agentguard import (
AgentGuardError,
BudgetGuard,
LoopGuard,
RateLimitGuard,
TimeoutGuard,
Tracer,
)
budget = BudgetGuard(max_calls=3)
loop = LoopGuard(max_repeats=3)
rate = RateLimitGuard(max_calls_per_minute=60)
timeout = TimeoutGuard(max_seconds=5)
tracer = Tracer(service="inbox-agent", guards=[rate])
try:
with timeout:
with tracer.trace("agent.run") as span:
for step in range(5):
budget.consume(calls=1)
loop.check("search", {"query": "same query"})
span.event("tool.call", data={"step": step, "tool": "search"})
except AgentGuardError as exc:
print(f"AgentGuard stopped the run: {exc}")from agentguard import AgentGuardError, BudgetGuard, LoopGuard, TimeoutGuard, Tracer
from agentguard.instrument import patch_openai
from openai import OpenAI
budget = BudgetGuard(max_cost_usd=2.00, max_calls=20)
loop = LoopGuard(max_repeats=3)
timeout = TimeoutGuard(max_seconds=300)
tracer = Tracer(service="support-agent")
patch_openai(tracer)
client = OpenAI()
try:
with timeout:
with tracer.trace("agent.openai") as span:
for step in range(20):
budget.consume(calls=1)
span.event("agent.step", data={"step": step})
response = client.chat.completions.create(
model="gpt-4o-mini",
messages=[{"role": "user", "content": "Summarize this inbox"}],
)
loop.check("chat.completions.create", {"step": step})
print(response.choices[0].message.content)
break
except AgentGuardError as exc:
print(f"AgentGuard stopped the run: {exc}")Agent policy, audit, and runtime guardrails. Self-hosted. MCP-aware. Works with the model providers and frameworks you already use.
Allow or deny tool calls per declarative policy. Stop an agent from touching a tool you never approved.
from agentguard import PolicyGuard
policy = PolicyGuard.from_file("policy.yml")
policy.check_tool("github.delete_repo", args)Every decision, every payload digest, structured output. Replay what the agent did and why it was allowed.
from agentguard import Tracer
tracer = Tracer(service="inbox-agent", sink="jsonl:/var/log/agent.jsonl")
tracer.event("tool.call", data={"tool": "search"})Works with Anthropic, OpenAI, and local LLMs. Same policy, same audit, regardless of which model you call.
from agentguard.instrument import patch_openai, patch_anthropic
patch_openai(tracer)
patch_anthropic(tracer)Hard ceilings on spend, calls, and call rate. Raises before the run keeps spending.
from agentguard import BudgetGuard, RateLimitGuard
budget = BudgetGuard(max_cost_usd=5.00, max_calls=50)
rate = RateLimitGuard(max_calls_per_minute=60)Feed your existing dashboard. Traces and metrics ship as OTLP to the collector you already run.
from agentguard.exporters import OtlpExporter
exporter = OtlpExporter(endpoint="http://otel-collector:4317")
tracer = Tracer(service="prod-agent", exporters=[exporter])No telemetry leaves your network unless you wire it. Self-hosted by default. Prompts and responses never leave your infra.
# Local JSONL sink, no outbound calls
tracer = Tracer(service="phi-agent", sink="jsonl:/secure/audit.jsonl")Teams who need to prove what their agents did, not just hope they behaved.
Healthcare, finance, government. Self-hosted policy + audit that meets your compliance review.
One governance layer across every agent your developers deploy. MCP-aware out of the box.
Approve agent deployments with confidence. Decision logs, payload digests, replayable history.
The open source SDK and MCP server are always free. Pro and Team add the hosted dashboard, read keys, longer event history, and email alerts.
| Open source | Pro | Team | |
|---|---|---|---|
| Price | Free | $39/mo | $79/mo |
| Runtime guards | yes | yes | yes |
| Local telemetry | yes | yes | yes |
| MIT license | yes | yes | yes |
| Read-only MCP server | Free pkg | Read key | Team keys |
| Hosted dashboard | no | yes | yes |
| Event history | Local | 500K | 5M |
| Users | 1 | 1 | 10 |
| Email alerts | no | yes | yes |
| Team visibility | no | no | yes |
pip install agentguard47 | Start trial | Start trial |
AI agent builds, real costs, what works. M-F only when there is something worth sending. No fluff.
I wrote AgentGuard because the existing options all point at a different problem. Lakera is about prompt injection. Guardrails AI is about output validation. Platform-native guardrails ship with a single vendor and lock you in. None of them stop an agent from burning $200 of OpenAI credit in a runaway loop at 2 AM.
AgentGuard is runtime only. It sits between your code and the model, counts cost and tool calls and wall-clock time, and raises before you get the surprise bill. It works the same whether you're calling GPT-5, Claude, a local llama.cpp server, or something I haven't heard of yet.
I built it for my own agents. I run it on my autotrader and on the agents that post this blog. If it works for me at 2 AM, it should work for you.