What Is AI Agent Security?
Mix (9 tools)
- License: 9 open source · 0 proprietary
- Hosting: 9 self-hosted · 0 SaaS · 0 both
AI agent security is the practice of securing autonomous and tool-using AI agents – systems that plan, call tools, browse, write code, and act on their own – rather than securing a single model prompt or a traditional application. As agents gain the ability to read and write memory, call external APIs, run code, and chain tools together, they introduce risks that classic AppSec, SIEM, and LLM-output tooling do not fully cover:
- Excessive agency / egress – an agent sends data or credentials somewhere it should not, or takes an action beyond its remit
- Prompt injection & tool poisoning – untrusted content or a malicious tool subverts the agent’s instructions
- Memory poisoning – an attacker corrupts the agent’s persistent memory to influence future runs
- Credential theft – secrets in the environment or toolchain are exfiltrated through the agent
- Shadow AI surface – undocumented, exposed agent and model endpoints (MCP, Ollama, vLLM, etc.)
This category tracks the fast-emerging open-source tooling built specifically for these problems. It is distinct from llm-eval/ (evaluating and guard-railing model outputs), ai-dev-tools/ (coding assistants that call LLM APIs), and ai-ml/ (model training / MLOps).
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
These tools address different stages of the AI-agent lifecycle – discovery, testing, detection, and runtime defense – so they are largely complementary rather than competing.
Function Matrix
| Tool | Area | Deploy Point | Enforcement |
|---|---|---|---|
| AIMap | Discovery | External scan | Detect-only |
| RAMPART | Testing | CI (pytest) | Gate (pass/fail) |
| Clarity | Design review | Design-time | Advisory |
| Agent Threat Rules | Detection rules | CI / SIEM | Alert* |
| Agent Beacon | Telemetry | Runtime (local) | Observe |
| Pipelock | Egress firewall | Runtime proxy | Block |
| Agent Memory Guard | Memory defense | Memory wrapper | Block/quarantine |
| Kiji Privacy Proxy | Prompt PII masking | Runtime proxy | Mask |
| Praxen | Behaviour verify | Pre-deploy | Report (read-only) |
* = Agent Threat Rules ships enforce/alert/hunt lanes; blocking is off by default.
Threat Coverage
| Tool | Egress / DLP | Prompt Injection | Memory | Tool / MCP | Surface Discovery |
|---|---|---|---|---|---|
| AIMap | No | No | No | Tests | Yes |
| RAMPART | No | Tests | No | Tests | No |
| Clarity | No | Design | No | Design | No |
| Agent Threat Rules | Detect | Detect | No | Detect | No |
| Agent Beacon | Observe | Observe | No | Observe | No |
| Pipelock | Yes | Yes | No | Yes | No |
| Agent Memory Guard | Redact | Yes | Yes | No | No |
| Kiji Privacy Proxy | Yes | No | No | No | No |
| Praxen | Verify | Verify | Verify | Verify | No |
Tests = exercised via adversarial test cases; Detect = detection rules only; Observe = logged, not enforced; Verify = checked against declared policy, not blocked at runtime.
Standards Mapping
| Tool | OWASP Agentic/LLM | MITRE ATLAS | NIST AI RMF | Other |
|---|---|---|---|---|
| AIMap | Yes | – | – | – |
| RAMPART | Yes | – | – | PyRIT-based |
| Clarity | Indirect | – | – | – |
| Agent Threat Rules | Yes | Yes | Yes | SAFE-MCP |
| Agent Beacon | – | – | – | OpenTelemetry |
| Pipelock | Yes | – | – | – |
| Agent Memory Guard | Yes (ASI06) | – | – | – |
| Kiji Privacy Proxy | Indirect | – | – | – |
| Praxen | Yes | – | – | RAISE score |
Licensing
| Tool | License | Cost | Steward |
|---|---|---|---|
| AIMap | MIT | Free | Bishop Fox |
| RAMPART | MIT | Free | Microsoft |
| Clarity | MIT | Free | Microsoft |
| Agent Threat Rules | MIT | Free | Community |
| Agent Beacon | MIT | Free | Asymptote Labs |
| Pipelock | Apache-2.0* | Free | PipeLab |
| Agent Memory Guard | Apache-2.0 | Free | OWASP |
| Kiji Privacy Proxy | Apache-2.0 | Free | Dataiku |
| Praxen | Apache-2.0 | Free | Community |
* = Pipelock core is Apache-2.0; enterprise / multi-agent features are Elastic License 2.0.
Maturity Note
This is one of the youngest categories in the corpus. Every tool here appeared in 2026, scope and naming are shifting, and several projects have already broadened beyond their original pitch (e.g. Agent Beacon toward a memory layer, Clarity toward general design review). Treat these as a fast-moving landscape to track, not a settled tool set, and re-verify specifics before relying on any one in production.
Tools
9 tools.
Agent Beacon
Agent Beacon is an open-source telemetry layer for AI coding agents that configures OpenTelemetry export and normalizes agent actions into a local, auditable event log.
License: MIT (OSS) · Kind: web · Deploy: docker, package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Agent Threat Rules (ATR)
Agent Threat Rules (ATR) is an open, Sigma-like detection-rule standard and engine for AI-agent threats such as prompt injection, tool poisoning, and credential theft.
License: MIT (OSS) · Kind: web · Deploy: package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
AIMap
AIMap is an open-source platform that discovers internet-exposed AI/agent infrastructure, fingerprints it, scores its exposure, and runs opt-in protocol attack suites against authorized targets.
License: MIT (OSS) · Kind: web · Deploy: docker, package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Clarity (Microsoft)
Clarity is Microsoft’s open-source structured design-review tool that acts as an AI “thinking partner” to surface failure modes and keep the plan current when building AI agents.
License: MIT (OSS) · Kind: web · Deploy: package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Kiji Privacy Proxy
Kiji Privacy Proxy is Dataiku’s open-source local gateway that detects and masks PII in prompts before they reach external AI providers, restoring the original values in responses.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
OWASP Agent Memory Guard
OWASP Agent Memory Guard is a runtime defense layer that sits between an AI agent and its memory store, screening every read and write to prevent memory poisoning and data leakage.
License: Apache-2.0 (OSS) · Kind: web · Deploy: package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Pipelock
Pipelock is an open-source “AI agent firewall” that enforces verifiable egress control between AI agents and the network, blocking credential leaks, SSRF, and malicious tool calls.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, k8s, package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Praxen
Praxen is an open-source AI agent behavior verifier that compares an agent’s declared policy against code, deployment state, and logs, then reports where the agent diverges from its remit.
License: Apache-2.0 (OSS) · Kind: web · Deploy: package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
RAMPART (Microsoft)
RAMPART is Microsoft’s open-source, pytest-native safety and security testing framework for agentic AI applications, letting developers gate adversarial-scenario tests in CI.
License: MIT (OSS) · Kind: web · Deploy: package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
