Authensor is an open-source safety layer that sits between your AI agent and the tools it uses. It checks every action against a policy before it executes, scans content for threats like prompt injection and PII leaks, and creates a tamper-evident audit trail. It works with any AI framework including LangChain, CrewAI, OpenAI Agents SDK, Claude, and MCP servers.

What is an AI agent safety layer?

An AI agent safety layer is software that intercepts actions an AI agent wants to take and decides whether those actions should be allowed, blocked, or sent to a human for approval. Think of it as a firewall for AI behavior. Without one, agents can delete files, leak credentials, make unauthorized API calls, or send data to the wrong place.

Do I need Authensor if I already use Claude, ChatGPT, or LangChain?

Yes. These tools give your agent capabilities like file access, shell commands, API calls, and web browsing. They don't have built-in policies for what's allowed. Authensor adds that missing safety layer. It works alongside any AI tool or platform you already use.

How is Authensor different from prompt engineering or system prompts?

System prompts are instructions that the AI can be tricked into ignoring through prompt injection. Authensor enforces rules in code, outside the AI model. A policy that blocks 'rm -rf' cannot be overridden by a clever prompt. It is deterministic enforcement, not probabilistic guidance.

Yes. Authensor is MIT licensed and fully open source. You can self-host everything, including the control plane with PostgreSQL, at no cost using Docker Compose. There is an optional hosted tier for teams that want managed infrastructure.

How do I get started with Authensor?

Run 'npx create-authensor' in your terminal. It generates a working project with Authensor wired in. You can choose from five templates: TypeScript agent, Python agent, Claude Code hooks, MCP Gateway, or Docker self-hosted control plane.

What AI frameworks does Authensor work with?

Authensor works with LangChain, LangGraph, CrewAI, OpenAI Agents SDK, Claude Code (via hooks), any MCP server (via the MCP Gateway), and any custom agent through the TypeScript or Python SDK. It is framework-agnostic.

Does Authensor detect prompt injection?

Yes. The Aegis content scanner includes 20+ prompt injection detection patterns covering instruction override, role manipulation, delimiter injection, encoding attacks (base64, hex, unicode), and few-shot poisoning. It runs with zero dependencies and sub-millisecond latency.

Does Authensor help with EU AI Act compliance?

Yes. Authensor maps to EU AI Act requirements for high-risk AI systems including Article 12 (record-keeping via hash-chained receipts), Article 14 (human oversight via approval workflows), Article 9 (risk management via the RedTeam harness), and Article 13 (transparency via decision logging). The EU AI Act high-risk deadline is August 2, 2026.

What is the OWASP Agentic Top 10 for 2026?

The OWASP Top 10 for Agentic Applications (2026) is a risk taxonomy developed by 100+ industry experts. It covers ASI01 Agent Goal Hijacking, ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, ASI04 Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, and ASI10 Rogue Agents. Authensor covers all 10 through its policy engine, Aegis scanner (15+ prompt injection rules, 22 memory poisoning rules), Sentinel behavioral monitor (EWMA/CUSUM anomaly detection), and approval workflows.

How does Authensor compare to Galileo Agent Control or NeMo Guardrails?

Authensor is the only open-source framework that provides all four pillars: tool permissions, approval workflows, cryptographic audit trails, and content safety scanning. Galileo Agent Control (Apache 2.0) provides evaluation but lacks approval workflows and receipts. NeMo Guardrails focuses on conversational safety but not tool authorization. AWS AgentCore uses Cedar policies but is AWS-locked. Authensor is cloud-agnostic, self-hostable, and MIT licensed with 924+ tests.

What AI agent frameworks does Authensor integrate with?

Authensor has official adapters for LangChain/LangGraph, OpenAI Agents SDK, Vercel AI SDK, Claude Agent SDK, and CrewAI. It also integrates with Claude Code via hooks and any MCP server via the MCP Gateway. TypeScript and Python SDKs support any custom agent framework.

What is an MCP gateway?

An MCP gateway is a proxy server that mediates all communication between an AI agent and the MCP (Model Context Protocol) servers it connects to. Instead of the agent talking directly to tool servers, every request passes through the gateway where it is evaluated against safety policies.

The problem with direct MCP connections

MCP lets AI agents discover and call tools from external servers. A filesystem MCP server exposes file read/write tools. A database MCP server exposes query tools. When an agent connects directly, it can call any tool the server exposes with any arguments.

This creates risk:

A compromised MCP server could expose dangerous tools
A prompt injection could cause the agent to misuse legitimate tools
There is no log of what tools were called or with what arguments
There is no way to require approval for specific operations

What a gateway adds

The gateway runs as an MCP server itself. You point your agent at the gateway, and the gateway connects to the upstream MCP servers on the agent's behalf.

Agent → MCP Gateway → [Policy Check] → Upstream MCP Server
                    → [Content Scan]
                    → [Audit Log]

On every tool call, the gateway:

Scans the arguments for prompt injection and content threats
Evaluates the call against your YAML policy
Forwards allowed calls to the upstream server
Blocks or escalates calls that violate policy
Scans the response before returning it to the agent
Generates a hash-chained receipt

Gateway vs application-level guards

You can also enforce policies in your application code using the SDK. The gateway approach has different tradeoffs:

Gateway advantages: Works with any MCP client without code changes. One enforcement point covers all connected agents. Easy to deploy as infrastructure.

SDK advantages: More control over escalation handling. Lower latency (no extra network hop). Can access application context.

In many deployments, both are used together. The gateway provides a baseline, and the SDK adds application-specific rules.

Tool discovery

The gateway exposes the same tools as the upstream servers. Tool discovery (the listTools call) passes through unchanged. The agent sees the full tool catalog. Filtering happens at call time, not discovery time.

This is a deliberate design choice. If the agent cannot see a tool, it cannot explain to the user why an action is not available. By letting the agent see all tools but blocking calls that violate policy, the agent can provide useful error messages.

Deploying a gateway

The Authensor MCP gateway supports stdio and SSE transports. For production, run it as a persistent service and configure your agents to connect to it instead of directly to upstream servers. See the setup guide for instructions.