mocX
中文

Back to projects

Research prototype · Agent security

AgentGuard-Chain

Repository authorRepository created Jun 2026

A prototype that supervises the tool calls of LLM agents. It places the security boundary after the agent emits a tool call and before the tool runs, auditing, scoring, blocking and logging file access, command execution, API calls and outbound actions, and it detects cross-step chains such as “read sensitive data → send externally”.

Role: The contributor list contains only this account, which does not mean the work was done alone; the competition name and result are still to be added by the author.

  • Python
  • Streamlit
View code

Problem

Context

If tool calls generated by an agent run directly, they are exposed to prompt injection, tool-call hijacking, dangerous commands, sensitive file access, API privilege abuse and multi-step exfiltration. The project targets the competition topic “Security research on large models and their applications” and supervises the tool calls themselves rather than only filtering prompts.

What is implemented

Implemented
  • Input risk labelling for prompt injection, jailbreak-style requests and suspicious context.
  • Pre-execution review of file, command, API, message and email tool calls.
  • Behaviour-chain detection for cross-step risks such as “read sensitive data → send externally” and “write script → run script”.
  • Human confirmation with allow / ask / deny decisions; ask can auto-deny, auto-allow or prompt interactively.
  • Result inspection and redaction of keys, passwords and tokens in tool output.
  • Audit trail in JSONL (tool-call events, gateway decisions, results and explanations), shown in a Streamlit dashboard with metrics, alerts and risk chains.

Source: repository README, read on 28 Oct 2026

Architecture

Implemented
Agent / LLM planner
    ↓
ToolCallEvent
    ↓
AgentGuardGateway
    ↓
PolicyEngine + ParameterChecker + ChainDetector + RiskScorer
    ↓
allow / ask / deny
    ↓
Tool executor
    ↓
ResultInspector + OutputRedactor
    ↓
AuditLogger
    ↓
Dashboard

Source: repository README, read on 28 Oct 2026

Current status

Current status

The security gateway, the scripted and LLM modes of MiniAgent, guarded offline replay and a real-mode entry for CoreCoder, the risk explainer and a basic dashboard are complete.

The scripted dataset contains 200 cases with 228 tool calls, and 65 unit tests pass. These numbers are reported by the repository README; this site has not re-run them.

Source: repository README, read on 28 Oct 2026

  • Research prototype

    EvoTeam

    Team project · repository authorRepository created Sep 2026Ongoing

    An experience-driven system for evolving multi-agent organisations, built on openJiuwen Core. It runs tasks with the current Strategy and only proposes candidate strategies offline when evidence such as repeated failures crosses a threshold; a candidate changes the default organisation for later tasks only after independent validation.

    • Python
    • Pydantic
    • openJiuwen Core
    • SQLite
    Code

  • Research prototype

    aigc_detector

    Repository authorRepository created May 2026

    A repository for detecting AI-generated content and attributing it to source models, with modules for detection, provenance and data ingestion.

    • Python

  • Research prototype

    MARS

    Repository authorRepository created May 2026Ongoing

    A prototype memory engine for agents in enterprise collaboration, intended to turn Feishu chats, notes and meeting discussions into structured memory with provenance. It is currently a local MVP: data models, SQLite storage and sample chat ingestion are done; memory extraction and retrieval are not implemented yet.

    • Python
    • FastAPI
    • Pydantic
    • SQLite