agent-ward

AgentWard · 玄甲OS

AgentWard (玄甲) is a full-stack security operating system purpose-built for trustworthy, scalable AI agent deployment, with native code adaptation to OpenClaw. AgentWard unifies agent onboarding, secure reasoning, and trusted execution in one cohesive security architecture, with upcoming native support for other leading mainstream agent frameworks. Its heterogeneous defense-in-depth design rearchitects the agent workflow into five coordinated security layers across startup, perception, memory, decision-making, and execution, with dynamic cross-stage protections that verify foundation integrity, block adversarial deception, stop memory tampering, and validate every autonomous decision and high-risk command — a complete, end-to-end closed security loop that delivers on the promise of "trustworthy at inception, controllable throughout the process, and reliable in outcomes". If you find this repo useful, please cite our paper on the design of AgentWard architecture:

@misc{zhang2026agentwardlifecyclesecurityarchitecture,
      title={AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents}, 
      author={Yixiang Zhang and Xinhao Deng and Jiaqing Wu and Yue Xiao and Ke Xu and Qi Li},
      year={2026},
      eprint={2604.24657},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2604.24657}, 
}

Why AgentWard

🛡️ Comprehensive Risk Coverage — Heterogeneous Defense-in-Depth (DiD) architecture delivers full-scope agent security assurance, blocking diverse attack vectors across the entire agent attack surface.
⚡ One-Click Deployment — Plugin-native design weaves security natively into the full agent lifecycle. Enable comprehensive agent security with one click via non-intrusive integration, which guarantees seamless and fast version adaptation for OpenClaw.
🔒 Deterministic System-Level Controls — Delivers deterministic, fully auditable, code-enforced security that outperforms skill-based solutions depending on endogenous security, with native support for large-scale deployment and production-grade readiness.
🌐 Open & Extensible Security Standard — Community-driven, transparent and auditable open standard with a modular architecture designed for extensibility. Built with complete framework-algorithm decoupling for effortless integration of advanced detection algorithms, with a roadmap to extend support to general agentic systems.

Quick Start

1. ⚡ Installation or Update

   # Run the setup script
   bash /path/to/agent-ward/setup.sh

2. ✅ Verify Installation

   openclaw plugins list

Then enjoy enhanced security for your OpenClaw!

Systematic Architecture

AgentWard is natively and deeply integrated with the OpenClaw platform and embeds native security capabilities into the full lifecycle workflow of AI agents. Its heterogeneous defense-in-depth architecture reconstructs isolated single-point security checks into a closed-loop, coordinated system-level protection system, delivering end-to-end, full-chain trustworthy assurance for AI agents from startup through to execution.

!AgentWard Blueprint

Five Coordinated Defense Layers

AgentWard delivers system-level security through five tightly integrated layers that work in tandem — transforming isolated security checks into a unified, end-to-end protection system for AI agents.

| Layer | Focus | | ----------------------------- | ----------------------------------------- | | 🏗️ Foundation Scan Layer | Supply chain trust and baseline integrity | | 🧼 Input Sanitization Layer | Prompt injection and jailbreak detection | | 🧠 Cognition Protection Layer | Memory poisoning and context drift | | 🎯 Decision Alignment Layer | Intent consistency before action | | 🔧 Execution Control Layer | High-risk operation guardrails |

🚨 Threat Response and Mitigation

📢 Send alert messages via IM when threats are detected
🛑 Automatically block dangerous operations without human intervention
📝 Clear warning descriptions to help understand risks

⚙️ Flexible Configuration

🎚️ Each protection layer can be enabled/disabled independently
👁️ Supports "detection-only" mode to reduce false positive impact
📋 Some layers support custom rules to meet specific scenario requirements

Defense Visualization

🏗️ Layer 1: Foundation Scan

Ensures the agent starts from a trustworthy foundation.

<div align="center"> <table> <tr> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">English Version</p><video title="Foundation Scan - English Demo" alt="Foundation Scan Layer demonstration in English" src="https://github.com/user-attachments/assets/6fda841d-febb-4653-a096-013ed5881b66" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">Chinese Version</p><video title="Foundation Scan - 中文演示" alt="Foundation Scan Layer demonstration in Chinese" src="https://github.com/user-attachments/assets/780ee830-29e0-4a41-a417-8ccbf55b3d32" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> </tr> </table> </div>

🧼 Layer 2: Input Sanitization

Identifies adversarial inputs before they propagate into the agent.

<div align="center"> <table> <tr> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">English Version</p><video title="Input Sanitization - English Demo" alt="Input Sanitization Layer demonstration in English" src="https://github.com/user-attachments/assets/d0ba7218-2e9d-4bba-893c-36bddc2b397d" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">Chinese Version</p><video title="Input Sanitization - 中文演示" alt="Input Sanitization Layer demonstration in Chinese" src="https://github.com/user-attachments/assets/ebba60e9-ea69-4cb8-8616-cb2d3448ffcc" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> </tr> </table> </div>

🧠 Layer 3: Cognition Protection

Protects long-term memory and contextual continuity from poisoning.

<div align="center"> <table> <tr> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">English Version</p><video title="Cognition Protection - English Demo" alt="Cognition Protection Layer demonstration in English" src="https://github.com/user-attachments/assets/914c0d4b-32ee-4336-9de9-3dff9ccc1bc8" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">Chinese Version</p><video title="Cognition Protection - 中文演示" alt="Cognition Protection Layer demonstration in Chinese" src="https://github.com/user-attachments/assets/83e82763-9346-4567-9463-f657b87a4097" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> </tr> </table> </div>

🎯 Layer 4: Decision Alignment

Keeps agent decisions aligned with authorized user intent.

<div align="center"> <table> <tr> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">English Version</p><video title="Decision Alignment - English Demo" alt="Decision Alignment Layer demonstration in English" src="https://github.com/user-attachments/assets/59e0235c-b794-4971-b36d-667279629388" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">Chinese Version</p><video title="Decision Alignment - 中文演示" alt="Decision Alignment Layer demonstration in Chinese" src="https://github.com/user-attachments/assets/05cc949e-88c5-428c-a54b-bb81f3715922" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> </tr> </table> </div>

🔧 Layer 5: Execution Control

Enforces safety boundaries at the point of execution.

<div align="center"> <table> <tr> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">English Version</p><video title="Execution Control - English Demo" alt="Execution Control Layer demonstration in English" src="https://github.com/user-attachments/assets/eb705acf-12c7-4b86-a3bb-73e8ecfeb249" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> <td align="center" width="50%"><p style="margin:0 0 8px 0; color:#666; font-size:13px;">Chinese Version</p><video title="Execution Control - 中文演示" alt="Execution Control Layer demonstration in Chinese" src="https://github.com/user-attachments/assets/7f0b604f-0783-4bfb-afd5-dcff0871c89b" controls preload="metadata" style="width:100%; max-width:400px; height:225px; object-fit:cover;"></video></td> </tr> </table> </div>

Roadmap

🏆 End-to-End Full-Stack Security System

Our roadmap is structured around a multi-layered defense architecture designed to secure the entire agent lifecycle, from configuration and input processing to cognition, decision-making, and execution.

📐 System Infrastructure Framework

✅ Plugin-native modular architecture
✅ Base adapter suite
✅ Core detection engine
✅ Heuristic rule-based detection module
✅ Intent risk evaluation system
🚀 Trust-aware risk assessment capabilities
🚀 Heterogeneous OS support
✅ Linux
🚀 macOS
🚀 Windows

🏗️ Foundational Scanning Layer

✅ Global and plugin-level configuration security checks
✅ Semantic malicious skill detection
🚀 Skill source verification
🚀 Plugin dependency analysis
🚀 Hybrid natural language and code vulnerability detection

🧼 Input Sanitization Layer

✅ Rule-based injection and jailbreak detection
✅ Semantic coherence analysis for user inputs
✅ Fragmented malicious instruction detection
🚀 Multi-turn stealth attack detection
🚀 Secure malicious content rewriting and replacement
🚀 Multimodal injection attack detection

🧠 Cognitive Protection Layer

✅ Memory consistency evaluation and calibration
🚀 Malicious memory corpus construction and threat matching
🚀 Memory vectorization and outlier detection
🚀 Checkpoint-based memory recovery
🚀 Context drift detection and correction

🎯 Decision Alignment Layer

✅ Consistency validation between agent decisions and user intent
🚀 Static rule filtering and compliance verification
🚀 Multi-step trajectory reasoning audit
🚀 Risk-adaptive dynamic permission allocation
🚀 High-risk action identification and safe rewriting

🔧 Execution Control Layer

✅ Real-time interception and blocking of high-risk system instructions
✅ Behavioral intent analysis and risk assessment
🚀 Identity-aware dynamic permission control and access restriction
🚀 Pre-execution security validation for agent actions
🚀 Automatic rollback and recovery for abnormal execution states
🚀 eBPF-powered system-level observability
🚀 Real-time resource monitoring and adaptive restriction
🚀 Network payload auditing and anomaly detection

🤝 Cross-Layer Collaboration

✅ Global information aggregation and risk discovery
🚀 Historical behavior-based trust profiling
🚀 Role-aware risk scoring and dynamic permission allocation
🚀 Taint propagation and end-to-end system auditing

Legend: ✅ Completed | 🚀 In Progress

Acknowledgements

We would like to thank all the contributors of this repository. They are Qi Li, Xinhao Deng, Yixiang Zhang, Jiaqing Wu, Yue Xiao, Rennai Qiu, Zhuoheng Zou, Jiaqi Bai, Jiaxing Song, and Ke Xu.

Summary

Install to Claude Code