Library

agent-shield

The governance layer this agent runs on, lifted out of the demo so you can read it on its own: Cedar policies, an audit log, a kill-switch, an MCP scope check, and a circuit breaker, composed behind one shield() call. This is the reference extraction from the demo, not a product to adopt. The agent in this repo is its only integration.

the public API shape

import { shield } from "@sarthak/agent-shield";

const guard = shield({
  policies,    // Cedar policy set; authorize() checks each action
  audit,       // audit sink for decisions and step events
  killSwitch,  // halts a run at the next step boundary
  scopeCheck,  // least-privilege scope gate for MCP tools
  breaker,     // circuit breaker on a cost ceiling
});

// Wrap a workflow step: kill-switch, breaker, and step audit run
// around it. Inside the step, each tool call goes through
// guard.authorize() before it dispatches.
const governedStep = guard.wrap(step);

One function in, one wrapped step out. The agent in this repo is the reference integration: it passes its real Cedar policies, its audit sink (in-memory in the demo, mirrored to Langfuse traces), and a 0.50 USD circuit breaker into the same call shown here. Read the layer in packages/agent-shield/ and the policies it enforces in packages/policies/.

The five controls

policies

Cedar policy engine

The same policies in version control, checked via authorize() on every governed tool call. A deny returns a human-readable reason chain via formatDecision(), not a boolean.

audit

Audit log

Every step and governed tool call is recorded with its policy decision attached. The demo sink is in-memory, mirrored to Langfuse traces; AuditSink is the interface you back with a durable store.

killSwitch

Kill switch

A single flip halts an in-flight run at the next step boundary — the wrap() gate polls it before every workflow step.

scopeCheck

MCP scope check

Checks the scopes a tool requires against what the principal holds. Servers declare scopes in MCP tool _meta (an agent-shield convention); tools that declare nothing are denied by default, before the call leaves the process.

breaker

Circuit breaker

Trips when cumulative spend crosses a cost ceiling (0.50 USD by default), stopping a runaway loop before it bills.

How the layer is structured

The policies it enforces, plus seven modules behind the one shield() call. Each is here in the repo to read; nothing is hidden behind a package boundary.

packages/policies/policies/*.cedar

The eight Cedar policies, the same files the agent enforces and the /policies page renders.

agent-shield/src/policy/

Cedar evaluation plus formatDecision(), which turns a deny into a human-readable reason chain.

agent-shield/src/audit/

The audit sink interface, the in-memory demo sink, and the event shapes the agent emits.

agent-shield/src/kill-switch/

The per-step kill-switch check the wrap() boundary polls.

agent-shield/src/scope-check/

MCP scope discovery via tool _meta and the granted-scope check that denies undeclared tools by default.

agent-shield/src/circuit-breaker/

The cost-ceiling and duplicate-call breaker that halts a runaway loop.

agent-shield/src/injection/

The detector that scans untrusted retrieved content and quarantines it before the planner (ASI01).

agent-shield/src/transform/

The PII-redaction transform applied to reads a policy only permits when redacted (policy 03).