Pre-run skill and server scanning
Checks AI agent skills and MCP servers before an agent loads them, using ATR detection rules to catch known attack patterns such as prompt injection, tool poisoning, and supply-chain threats.
Panguard AI
Panguard AI secures AI agents by scanning skills and MCP servers for threats before run time, then protecting actions at runtime for developers and regulated teams.
Overview
Panguard AI is an AI agent security product that scans skills and MCP servers for threats before they run, then continues to guard agent actions at runtime. The site positions it as a way for developers and regulated teams to reduce exposure to prompt injection, tool poisoning, malicious MCP content, and related supply-chain risks.
The product is built around ATR, an open rulebook of executable detection rules. The community edition is free, MIT licensed, self-hosted, and described as running offline with zero telemetry. Paid plans add support for proving security in enterprise review workflows, including signed compliance evidence packs and larger deployments.
Core capabilities
Runtime protection
Monitors agent activity at runtime so it can catch and contain hijack attempts after an agent starts executing actions.
Audit evidence generation
Produces signed, audit-ready evidence rather than just a detection result, including PDF and JSON outputs mapped to compliance frameworks.
Local-first deployment
Runs locally and is described as self-hosted, offline, and zero-telemetry, which supports teams that want on-device protection.
Open rulebook and rule updates
Uses a shared ATR rulebook that is open source and updated through community rules, with rule updates delivered through the Threat Cloud in under 24 hours on the community plan.
CLI-driven workflow
Supports a CLI workflow with commands for scanning, auditing, guarding, and checking status.
Common use cases
Pre-deployment safety checks
Run a skill or MCP server through a pre-flight scan before letting an agent use it, so suspicious instructions or package content can be blocked earlier in the workflow.
Runtime guardrails for live agents
Keep protection active while an agent is acting, for cases where a clean pre-scan is not enough and runtime behavior still needs containment.
Compliance evidence packages
Generate signed evidence and framework mappings for security, audit, or procurement review when a team needs to show how agent risks were checked.
Self-hosted team use
Use the free, self-hosted community edition for individual developers or small teams that want local protection without a hosted service.
Enterprise review workflows
Move to the paid founding pilot or enterprise offering when the goal is not only protection but also support, review-ready documentation, and larger deployment needs.
Pros and Cons
Pros
- Combines pre-run scanning with runtime protection in one workflow.
- Uses an open, MIT-licensed rulebook that is shared across users.
- Can generate signed evidence for audit and compliance reviews.
- Supports local, offline, self-hosted use with zero telemetry.
- Offers a clear split between a free community edition and paid plans for proof-oriented deployments.
Cons
- The public site leaves several integration details unspecified, including broader SIEM, webhook, export, and platform-hook coverage beyond what is mentioned in the enterprise materials.
- The source does not fully spell out all supported environments or the exact boundaries of what the detection rules do not cover.
- Some compliance and enterprise features are tied to paid or sales-led plans, so the free edition is focused more on self-hosted protection than on audit-pack delivery.
FAQ
How do you set it up?
Panguard AI is installed locally with a one-line command and runs offline. The site says it is MIT licensed, self-hosted, and has zero telemetry.
Who is it for?
The product is aimed at developers, AI vendors, regulated teams, and enterprises that need to scan AI agent skills or prove security in review processes. The pricing page distinguishes a free community edition from paid offerings for compliance evidence and larger deployments.
Does it scan before execution or only while agents are running?
The home page says it scans skills and MCP servers before they run, and also guards agent actions at runtime. The product therefore covers both pre-run scanning and runtime protection.
What kind of output does it generate?
It can produce signed, audit-ready evidence and reports. The site mentions PDF and JSON outputs, SHA-256 and Merkle-tree signing, and evidence packs mapped to compliance frameworks.
Are there any known limitations or boundaries?
The site is conservative about scope: it focuses on skills, MCP servers, and agent actions. It also notes that some capabilities, such as optional LLM second opinion and collective defense, are off by default.
Quick Facts
- Category
- AI agent security
- Platform
- Self-hosted, local-first, offline
- Primary users
- Developers, AI vendors, regulated teams, enterprises
- Source domain
- panguard.ai
- License
- MIT
- Pricing shape
- Free community edition; paid founding pilot and enterprise plans
Panguard AI Alternatives
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads in Firecracker micro-VMs with private networking and SDK, CLI, or MCP control.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.
AakarDev AI
AakarDev AI helps teams manage AI provider access, project setup, logs, and analytics in one dashboard. BYOK support included.
Arduino VENTUNO Q
Arduino VENTUNO Q is an edge AI computer for AI and robotics, combining AI inference and deterministic control on one board with Arduino App Lab support.
Devin
Devin is an AI coding agent and software engineer for planning and executing complex software tasks, with desktop, cloud, JetBrains, and CLI access.