Framework to block harmful AI agent actions before they cause harm — lightweight, real-time, easy-to-use.
Python package support: Python 3.10 through Python 3.14.
pip install agent-action-guard
# or
uv add agent-action-guardFor embedding backend options and configuration details—including zero-config ONNX embeddings, custom local ONNX models, OpenAI-compatible embedding APIs, environment variables, and backend precedence—read USAGE.md. The installed packages also provide
agent-action-guardfor direct JSON, JSON arrays, JSONL batch classification, andagent-action-guard servefor a local HTTP classification API.
Python framework integrations are included in the same package: agent_action_guard.langchain, agent_action_guard.llamaindex, agent_action_guard.openai_agents, agent_action_guard.autogen, and agent_action_guard.crewai. No separate integration package is required.
Pre-tool-use harness hooks are also built in for Codex, Claude Code, Cursor, Kiro, OpenCode, Antigravity CLI (agy), GitHub Copilot CLI, OpenClaw, and Hermes Agent:
agent-action-guard hooks install --target codex
# or: claude-code, cursor, kiro, opencode, agy, copilot, openclaw, hermesOpenClaw and Hermes intentionally retain their project-plugin trust gates. After installing the OpenClaw hook, explicitly enable agent-action-guard with openclaw plugins enable agent-action-guard. For Hermes, start trusted repositories with HERMES_ENABLE_PROJECT_PLUGINS=1 so the generated .hermes/plugins/agent-action-guard/ plugin is loaded.
Want to run the evaluation benchmark too?
pip install "agent-action-guard[harmactionseval]"
# or
uv add "agent-action-guard[harmactionseval]"
agent-action-guard harmactionsevalHarmActionsEval caches each model's k value alongside its results. Re-running
the same benchmark with a larger --k keeps successful cached results and only
continues entries that are still false, starting at the first previously
unevaluated attempt. Re-running with the same or a smaller --k does not repeat
cached LLM calls. The last_attempt map records per-result attempt coverage for unresolved false entries so the same behavior stays correct when runs use --offset/--limit chunks.
The repository also ships an npm package in typescript/package.json for screening agent actions in Node.js.
npm install agent-action-guardIf you use pnpm, the equivalent commands are:
pnpm install agent-action-guardHarmActionsEval found harmful tool use in every evaluated model under its reported adversarial prompts and tool setup. These results describe the tested conditions, not every deployment. 68% of the completed LLM evaluations executed actions at the first attempt for over 95% of the harmful prompts.
| Model | SafeActions@1 |
|---|---|
| Gemini 3.8 Flash | 79.43% |
| Claude Opus 5 | 48.23% |
| GPT 6.1 Sol | 25.53% |
| Qwen 3.5 397B A17B | 23.40% |
| Claude Sonnet 5 | 3.55% |
| GPT 6 Luna | 3.55% |
| Grok 4.20 Non Reasoning | 2.13% |
| Gemini 3.1 Flash Lite | 0.71% |
| All 19 model average | 11.91% |
These models often still respond "Sorry, I can't help with that" after executing the harmful action anyway.
Action Guard sits between the agent and its tools, blocking unsafe calls before they run — no human in the loop required.
Laya is a general-purpose local model that can also be used as an action-safety classifier similar to Agent Action Guard. The comparison script evaluates Agent Action Guard, Laya, and an OpenAI LLM classifier on the same HarmActions rows. The two local systems are forced to CPU execution, and warm-up/model-loading time is excluded from the reported per-action latency.
cd python
python scripts/compare_laya_harmactions.py| Model | HarmActions | Accuracy | Precision | Recall | F1 | ms/action |
|---|---|---|---|---|---|---|
| Agent Action Guard | 97.87% | 97.87% | 100.00% | 97.87% | 98.92% | 19.66 |
| gpt-5.6-luna | 90.07% | 90.07% | 100.00% | 90.07% | 94.78% | 3381.72 |
| Laya | 51.06% | 51.06% | 100.00% | 51.06% | 67.61% | 815.86 |
The charts use the same values as the table above: higher is better for classification quality, while lower is better for latency.
- Agent proposes a tool call
- Action Guard classifies it using a lightweight neural network trained on the HarmActions dataset
- Harmful calls are blocked; safe calls proceed normally
- 📊 HarmActions — safety-labeled agent action dataset with manipulated prompts
- 📏 HarmActionsEval — benchmark with the SafeActions@k metric
- 🧠 Action Guard — real-time neural classifier optimized for agent loops
- 🏋️ Trained on HarmActions
- ✅ Screens wrapped tool calls before execution
- 🚫 Blocks harmful and unethical actions automatically
- ⚡ Lightweight for real-time use
Share a quick note in Discussions — it directly shapes the project's direction and helps the AI safety community. 🙌 Waiting with excitement for feedback and discussions on how this helps you or the AI community.
⭐ Star the repo if Action Guard is useful to you — it really does help!
@article{202510.1415,
title = {{Agent Action Guard: Classifying AI Agent Actions to Ensure Safety and Reliability}},
year = 2025,
month = {October},
publisher = {Preprints},
author = {Praneeth Vadlapati},
doi = {10.20944/preprints202510.1415.v2},
url = {https://www.preprints.org/manuscript/202510.1415},
journal = {Preprints}
}Licensed under CC BY 4.0. If you prefer not to provide attribution, send a brief acknowledgment to praneeth.vad@gmail.com with the details of your usage and the potential impact on your project.
Website and runtime data handling is described in the privacy notice. Both packages classify locally; configuring an embedding API sends action text to that endpoint. Pre-provision local embedding assets for offline use. The privacy and launch-feature review records the website audit and checks for future accounts, tracking, email, billing, or uploads.
See project terms and payment/refund scope, cookie information, and access/correction/deletion requests. The review includes the twenty-area launch checklist and accessibility checks; these describe the current implementation rather than certifying legal compliance.
The website launch review records responsive/link checks, sharing previews, browser-test commands, and verified source backups. Both static sites remain tracking-free and use the existing public contact email.
Projects for Next-Gen AI