OpenGuardrails
AI agent guardrails for every builder.
Let your agents do more, and walk away. Open source, and it runs on your machine.
Apache-2.0 · openguardrails.com
Most of what an agent does is safe, and a rule can tell. OpenGuardrails decides those actions on
your machine, with no network and no model. It sends only the ones a rule cannot decide to a model
built to judge agent actions, so you stop being asked, and it tells you when something is wrong.
tool call -> local rules --- allow ------------------------------> runs
|-- deny ---------------------------------> refused
`-- cannot tell -> OpenGuardrails model
|-- allow ------------> runs
|-- unsafe -----------> refused, the agent is told why
`-- your decision ----> the agent asks you
Unsafe and "your decision" are different things. A key on its way to an unknown host is a security
problem, and it is refused. Nobody is asked to rule on it. Buying this lipstick is safe, and it is
still your call.
- Your keys stay home. Secrets become placeholders before a request leaves your machine, side
requests included, so the model provider and any relay never see them. A tool still gets the real
value, and only after its call is allowed.
- Local rules. A strict shell parser, a read-only allowlist, workspace boundaries and a small
list of things no agent should ever do. A command the parser does not fully understand is never
allowed by a rule. Read them: ,
.
