Show HN: AgentWard – After an AI agent deleted files, I built a runtime enforcer
https://github.com/agentward-ai/agentward
I've spent time working on AI safety and kept running into the same problem: AI agents have far more access than they need, and the only thing stopping them from misusing it is a prompt. Prompts can be ignored. They can be overridden by prompt injection. They're not enforcement — they're a suggestion. AgentWard is a proxy layer that sits between your agent and its tools and enforces permissions in code, outside the LLM context window. No matter what the model decides, the policy is what actually runs. What it does:Scans your OpenClaw skills and flags risky permissions Detects dangerous skill combinations — pairs that are low-risk individually but become high-risk when chained together (email + web browser → data exfiltration path) Enforces a YAML policy at runtime — ALLOW, BLOCK, APPROVE, REDACT Logs everything for audit
Getting started is one command: agentward init It scans, shows your risk profile, and wraps your environment with a sensible default policy in under two minutes. Honest caveats: Currently tested on OpenClaw skills and Mac only. MCP server support and Windows are on the roadmap — contributions welcome. This is early and rough in places, but the core enforcement works. I'm sharing it now because the problem is real and getting worse fast. Would love feedback from anyone running agents in production. GitHub: github.com/agentward-ai/agentward
Similar concept
I'm building AgentWard (https://github.com/agentward-ai/agentward), which comes at the problem from a different angle. The core difference is where enforcement happens:
GovernsAI looks like a centralized API service. The agent/SDK calls a precheck endpoint before acting, and the platform returns allow/deny/redact. Is that correct? This works great when you control the integration code and can guarantee every tool call goes through the precheck.
AgentWard is an inline proxy: It sits directly on the wire between the agent and its tools (MCP servers, HTTP gateways). The agent literally cannot make a tool call without it going through the policy engine first. There's no precheck API to forget to call, no client-side integration to get wrong. The enforcement is structural, not cooperative.
A few other differences:
1/ Zero infrastructure: pip install agentward && agentward scan gives you a permission map in seconds. No database, no Keycloak, no platform to deploy. 2/ MCP-native: Parses JSON-RPC 2.0 at the protocol level — intercepts tools/call, enumerates tools from live servers, auto-discovers configs from Claude Desktop/Cursor/Windsurf/VS Code. 3/ Static analysis + runtime: agentward scan tells you what each tool can access (data, network, credentials, chaining risks) before you even write a policy. Then agentward inspect enforces that policy at runtime. ->I think this is a HUGE value add. 4/ Skill chaining detection: Analyzes and blocks unauthorized tool-to-tool invocation chains (e.g. email content triggering a browser tool → code execution).
Honestly, I think these are complementary more than competitive — GovernsAI governs the organizational plane (who, how much, what data), AgentWard governs the execution plane (which tool calls happen, with what arguments, through what protocol). Different layers of the same governance stack.
If anyone wants to try it: "pip install agentward && agentward scan" — takes about 5 seconds and shows you exactly what every MCP server on your machine can access && also puts a safety wrapper for runtime checks.