GoPlusSecurity/agentguard
A real-time security layer for DeepSeek Harness agents: hooks that block destructive commands and secret writes, a 24-rule skill scanner, and a daily security patrol.
AgentGuard is a real-time security layer for AI coding agents, built in three layers. Layer 1 is an automatic guard installed as hooks: it blocks rm -rf /, fork bombs and curl | bash, prevents writes to .env, .ssh/ and credential files, detects exfiltration to Discord/Telegram/Slack webhooks, and tracks which skill initiated each action. Layer 2 is a deep scan with 24 detection rules that auto-scans new skills on session start and runs static analysis for secrets, backdoors, obfuscation and prompt injection, including Web3-specific patterns (wallet draining, unlimited approvals, reentrancy, proxy exploits). Layer 3 is a daily patrol of eight security checks on a configurable schedule that detects skill tampering, secrets exposure, network risks and suspicious file changes. The README pitches it as 'the first real-time security layer for AI agents'.
Install
dsh plugin --profile web add --allow-build=@goplus/agentguard @goplus/agentguardCopied verbatim from the README's '30 seconds: install' section. The --allow-build flag is part of the documented command (the package has a build step, so pnpm needs the build-script grant up front). Update or remove it from the same profile with dsh plugin --profile web update @goplus/agentguard or dsh plugin --profile web remove @goplus/agentguard; the README's operations guide (docs/dsh.md) covers verification and troubleshooting.
Compatibility
Installs through DSH's own plugin manager into a named profile (web in the README's example). No version floor is stated in the README's install section.
Details
- Repo: GoPlusSecurity/agentguard
- Category: Agent Capabilities
- Stars: 462
- Version: GitHub repo GoPlusSecurity/agentguard; npm package @goplus/agentguard at 1.2.1 (registry check 2026-10-07; registry repository field resolves back to this repo).
FAQ
- Does installing it require a build step?
- Yes — the README's install command passes --allow-build=@goplus/agentguard alongside the package, granting the build-script approval up front.
- How is it installed into DSH?
- As a DSH plugin into a named profile — the README's command targets --profile web, and update/remove use the same profile.
Alternatives
omdsh-dev/dsh-security-audit · bigclawd/dsh-security-guard · flyingtimes/dsh-trajectory-reader