Your agent is one document away from a breach.
A malicious PDF, email, webpage or retrieved memory can influence an autonomous agent's later actions. AgentInterdict intercepts that transition at runtime — blocking memory poisoning, tracking provenance, and revalidating every action before it executes. Because your agent should never act on anything it can't prove is trustworthy.
Watch an attack get interdicted.
Run a live, reproducible scenario. A malicious instruction embedded in an untrusted document tries to make the agent exfiltrate a credential — AgentInterdict catches it at the runtime boundary.
Right now, your agent is exposed.
Your local LLM reads files, browses the web, and calls tools — and every one of those inputs is a potential attacker. A single poisoned document can make your agent leak your API keys, ignore its instructions, or take destructive action. You won't know until it's too late.
One document. That's all it takes.
A malicious instruction hidden in a file, email or web page overrides your agent's system prompt — and it obeys without question.
Your credentials, exposed.
API keys, tokens and private keys get persisted into long-term memory, where the next injection can exfiltrate them.
False facts that persist.
Injected "facts" become permanent memory, corrupting every future decision your agent makes — for weeks.
Fake authority to act.
Content that claims to be from a trusted source gains unwarranted power over your agent's actions.
The question isn't whether you'll be attacked. It's whether you'll be protected when it happens.
Retrieving a document or recalling a memory puts content into your agent's context. That does not give that content the authority to execute an action. AgentInterdict enforces this separation at the runtime boundary — so untrusted context can never become executable authority. Why this is the core doctrine →
Every action passes through the interdict.
AgentInterdict sits at the runtime boundary of your agent. Nothing executes without passing provenance, trust, and authority verification.
Injection is deflected.
Obfuscated, encoded and split attacks are detected and knocked out of the stream before they can persist.
Secrets are masked.
Credential-shaped content is redacted to a hash — the secret itself never reaches memory.
Poison is contained.
Suspicious memories are quarantined and their entire derivation chain is contained atomically.
Authority is bound to origin.
Derived content can never outrank its source. High-risk actions require sealed, action-scoped human authorization.
Govern the code your agent writes.
Scan an AI-generated code diff with the same engine and record a signed, tamper-evident evidence verdict — so you can govern output, not just input.
A transparent pipeline, not a black box.
AgentInterdict is a local, auditable runtime. It never sends your agent's context to the cloud, and every decision is logged and verifiable.
Your agent's context never leaves your machine.
AgentInterdict's enforcement engine runs entirely on your hardware. Your agent's prompts, retrieved documents, tool outputs, and memories never leave the host — no cloud, no telemetry, no data exfiltration by construction.
- ✓ Enforcement is fully local — no cloud dependency
- ✓ Open and auditable
- ✓ Fail-closed by default
- ✓ Operator / runtime privilege separation
Always local, by construction: the enforcement engine, your agent's context, memory, provenance graph, audit log, and all Community-tier risk rules. None of these touch the network.
Optional remote features (paid tiers only): a signed lease, presented by your agent, unlocks remote-hosted services on the AgentInterdict control plane — the continuously-updated threat feed, a hosted semantic classifier, policy/compliance packs, and (Enterprise) anomaly detection & remote audit. These receive only the content you explicitly opt into sending for that feature, gated by your lease; they never receive your raw agent context by default, and you can run entirely offline on Community tier.
Engineered for precision.
{
"memory": "<recalled bundle>",
"action": "send_email",
"authority": "untrusted"
}
→ BLOCKED — high-risk action without sealed human authorization
See the enforcement, live.
Every decision is logged and auditable. The dashboard shows what was scanned, what was blocked, and why.
Enforcement summary
Recent events
Drop into your existing stack.
AgentInterdict wires into the agents and frameworks you already use. Enforce at the runtime boundary without rewriting your agent.
Drop-in enforcement layer for Hermes agents. Bind authority to origin on every memory write and tool action.
managed packSkill-based integration for OpenClaw. Guarded retrieval and action-time revalidation out of the box.
skillModel Context Protocol server. Intercept tool calls and memory operations before they reach your tools.
protocolLanguage-agnostic HTTP API — scan, memories, search, action-check, stats. Integrate from any stack.
apiTested. Auditable.
We publish our test suite and its results — passing and failing — so you can run it yourself. A security tool that hides its misses isn't trustworthy.
| Attack category | Attempts | Blocked | Block rate |
|---|---|---|---|
| Direct injection | 50 | 48 | 96% |
| Obfuscated / encoded | 50 | 47 | 94% |
| Multi-turn / split | 50 | 48 | 96% |
| Tool-call hijack | 50 | 50 | 100% |
| Total | 200 | 193 | 96.5% |
Measured on a fixed 200-attempt suite run through the actual enforcement engine. The 7 misses are documented with payloads in scripts/benchmark_injection.py so you can reproduce and assess them yourself. We do not publish block-rate percentages we can't reproduce.
Simple, transparent pricing
Community
- ✓ Origin-bound local gateway
- ✓ Static transparent risk rules
- ✓ Single-operator GUI
- ✓ Local audit & integrity verification
- ✓ Basic REST API
Pro
- ✓ Everything in Community
- ✓ Continuously updated threat feed
- ✓ Hosted advanced semantic classifier
- ✓ Hermes / MCP managed integration packs
- ✓ Audit export & reporting
- ✓ Remote policy updates
Business
- ✓ Everything in Pro
- ✓ Multi-agent / multi-namespace management
- ✓ Team accounts & RBAC
- ✓ Central policy packs
- ✓ Organisation dashboards
- ✓ Alerting & webhooks
Enterprise
- ✓ Everything in Business
- ✓ SSO / SAML
- ✓ Private cloud / VPC / on-prem
- ✓ Signed offline leases
- ✓ SIEM integration
- ✓ SLA & priority support
Don't run your agent exposed.
The Community tier is free. There is no reason to run unprotected. Protect your credentials, your memory, and your agent's integrity — before the wrong document finds it.
TRY TO BREAK AGENTINTERDICT
Fork the repo, run the public benchmark, and find a payload that gets through. The code is open, the misses are documented, and we publish honest results.