Security and trust

AgentX is an action firewall for AI agents. Agents no longer just chat; they take real actions: executing code, moving money, and calling APIs. AgentX checks what an agent is about to do and blocks the irreversible action before it runs, then hands the agent a safe path so the task still finishes. Because it sits that close to your systems, how it handles your data matters. This is a plain, honest account of that, and of where we are on security today. We are early, so parts of this are “here is what we do and do not do” rather than a wall of certifications.

Last reviewed July 2026.

Who is behind AgentX

Hi, I'm Vasu. I've spent my career in infrastructure and networking, at Cisco and Nokia and across four startups, including two with successful exits and one I co-founded. AgentX is early, and I built it. If you want to talk to a person about any of this, contact me on LinkedIn or in the AgentX Discord.

How AgentX handles your data

The SDK runs in your environment. The keyless Shield (the @agentx_protect decorator and the agentx-mcp proxy) checks each action locally, inside your own process. Your data does not leave your machine: it needs no API key, makes no LLM calls, and sends none of your prompts, code, or tool arguments anywhere. The dangerous call is stopped before it runs, in your process.

The SDK is open source. It is MIT-licensed and public, so you can read exactly what it does before you run it: agentx-security-sdk on GitHub.

The gateway is bring-your-own-key. Coached recovery and the deeper checks run through a gateway you can run yourself with Docker, using your own model key. Run it self-hosted and your data stays in your environment.

Telemetry is anonymous, coarse, and optional. The SDK sends an anonymous usage signal, an install id with the version and a few coarse counts, and never your payloads, prompts, or arguments. It tells you this on first run, and you can turn it off with AGENTX_TELEMETRY=off.

We did the homework in the open

We founded and maintain the ARE Incident Database (AREDB), a neutral, open registry of real, cited agent-failure incidents. It carries 33 incidents today, every one with a public source, 0 disputed and 0 withdrawn. It is not our marketing: it has its own domain, its own governance, and a coverage index any vendor can join.

Two things a reviewer can do with it. Read exactly which failures we claim to stop and which we do not, in our coverage claim against the registry. And check us: every published claim ships a test that runs in CI, so a claim that stops being true goes red on its own. The database and its checks are public on GitHub.

Our security posture, honestly

We are early and not yet SOC 2 certified. Here is what we actually do today:

  • The gateway ships a minimal, default-deny container image: only the runtime it needs to run, and nothing else in the image to attack.
  • Our enforcement code is open source (MIT), so what stops a dangerous action is auditable rather than a black box.
  • Hosted options (the Control tier) process only what you send them, using your own model key; self-hosting keeps everything in your environment.

Report a security issue

Found a vulnerability in AgentX, the SDK, the gateway, or this site? Message me on LinkedIn or in the AgentX Discord. I will acknowledge it and work with you on a fix. Please give me a reasonable window to address it before any public disclosure.