Documentation

From install to an honest gate.

AgentGuard has two distinct modes. Offline static checks need no account or API key. Behavioural simulation runs through a control plane. The output always says which mode ran and which coverage is still missing.

01 · offline quickstart

Run the first check locally

This validates structure, declared policies, and accidental credentials. It never executes a model or tool and never reads your environment variables.

$pip install agentguard-dev

$agentguard init

$agentguard scan --local

02 · CI

Choose the gate you mean

`agentguard init` writes a GitHub Actions workflow. A team may explicitly accept an offline partial gate while it prepares live behavioural simulation.

$agentguard scan --local --allow-incomplete-static --sarif findings.sarif

03 · behavioural simulation

Gate a real agent decision

Run or connect an AgentGuard control plane, then provide its URL, an API key, and the registered agent identifier. The model can be challenged while its real tools remain intercepted and unexecuted.

export AGENTGUARD_API_KEY=ag_your_key_here
agentguard scan \
  --api-url https://your-agentguard-host \
  --agent my-support-bot \
  --manifest manifest.json \
  --environment prod \
  --html report.html \
  --sarif findings.sarif

Reference

Exit-code contract

0allowed

10error

20blocked

30unknown

40incomplete

Fail closed by default: error, blocked, unknown, and incomplete all return non-zero.