agentgate

Why it exists

Platforms that let people run AI agents have a new problem: steal an agent session and you inherit everything that agent can do. Tokens, cookies and device IDs can be stolen, and malware in the owner's browser can act as the owner. agentgate makes the high-impact actions, like exporting data or sending output somewhere new, need a WebAuthn signature that only the owner's physical key or passkey can produce.

What's in the box

• WebAuthn key approval of sensitive actions. It stops token thieves and in-browser malware.
• Content policy: rules plus an optional model grounded in a human-vetted knowledge base.
• Behaviour baselines: new device at an odd hour, bursts, probing, topic drift.
• Device-bound signatures, decoys and tripwires, and transport/ISP/geo fingerprints.
• Hash-chained audit log with external anchoring, so history can't be silently rewritten.

Responses are graded: block, escalate to a human, step-up (re-verify), allow-and-log, or support. Python 3.9+, one dependency (cryptography). Status: alpha (v1.2.1), not yet independently reviewed.

Quick start

pip install agentgate-security
agent-gate redteam      # synthetic owners vs attackers

from agentgate import Gate, BehaviorMonitor, ApprovalService, build_meta

gate = Gate("audit.jsonl", "review.jsonl", monitor=BehaviorMonitor(),
            approvals=ApprovalService(registry, rp_id="example.com",
                                      origin="https://example.com", allow_simple=False))
meta = build_meta(request_headers, device=device_id, ip=ip,
                  sensitive_action="export:hooks.acme.com", destination=webhook_url)
d = gate.screen(operator_id, text, meta=meta, approval=client_approval)
if d.action == "STEP_UP" and d.challenge:
    ...  # pass d.challenge["webauthn_challenge"] to navigator.credentials.get()

Full docs, tests and the deployment checklist are in the GitHub repo.