Authensor is an open-source safety layer that sits between your AI agent and the tools it uses. It checks every action against a policy before it executes, scans content for threats like prompt injection and PII leaks, and creates a tamper-evident audit trail. It works with any AI framework including LangChain, CrewAI, OpenAI Agents SDK, Claude, and MCP servers.

What is an AI agent safety layer?

An AI agent safety layer is software that intercepts actions an AI agent wants to take and decides whether those actions should be allowed, blocked, or sent to a human for approval. Think of it as a firewall for AI behavior. Without one, agents can delete files, leak credentials, make unauthorized API calls, or send data to the wrong place.

Do I need Authensor if I already use Claude, ChatGPT, or LangChain?

Yes. These tools give your agent capabilities like file access, shell commands, API calls, and web browsing. They don't have built-in policies for what's allowed. Authensor adds that missing safety layer. It works alongside any AI tool or platform you already use.

How is Authensor different from prompt engineering or system prompts?

System prompts are instructions that the AI can be tricked into ignoring through prompt injection. Authensor enforces rules in code, outside the AI model. A policy that blocks 'rm -rf' cannot be overridden by a clever prompt. It is deterministic enforcement, not probabilistic guidance.

Yes. Authensor is MIT licensed and fully open source. You can self-host everything, including the control plane with PostgreSQL, at no cost using Docker Compose. There is an optional hosted tier for teams that want managed infrastructure.

How do I get started with Authensor?

Run 'npx create-authensor' in your terminal. It generates a working project with Authensor wired in. You can choose from five templates: TypeScript agent, Python agent, Claude Code hooks, MCP Gateway, or Docker self-hosted control plane.

What AI frameworks does Authensor work with?

Authensor works with LangChain, LangGraph, CrewAI, OpenAI Agents SDK, Claude Code (via hooks), any MCP server (via the MCP Gateway), and any custom agent through the TypeScript or Python SDK. It is framework-agnostic.

Does Authensor detect prompt injection?

Yes. The Aegis content scanner includes 20+ prompt injection detection patterns covering instruction override, role manipulation, delimiter injection, encoding attacks (base64, hex, unicode), and few-shot poisoning. It runs with zero dependencies and sub-millisecond latency.

Does Authensor help with EU AI Act compliance?

Yes. Authensor maps to EU AI Act requirements for high-risk AI systems including Article 12 (record-keeping via hash-chained receipts), Article 14 (human oversight via approval workflows), Article 9 (risk management via the RedTeam harness), and Article 13 (transparency via decision logging). The EU AI Act high-risk deadline is August 2, 2026.

What is the OWASP Agentic Top 10 for 2026?

The OWASP Top 10 for Agentic Applications (2026) is a risk taxonomy developed by 100+ industry experts. It covers ASI01 Agent Goal Hijacking, ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, ASI04 Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, and ASI10 Rogue Agents. Authensor covers all 10 through its policy engine, Aegis scanner (15+ prompt injection rules, 22 memory poisoning rules), Sentinel behavioral monitor (EWMA/CUSUM anomaly detection), and approval workflows.

What is an MCP Gateway?

An MCP Gateway is a transparent proxy between an MCP client and any MCP server that evaluates every tool call against policies before forwarding. Authensor's MCP Gateway implements the MCP SEP authorization protocol with authorization/propose, authorization/decide, and authorization/receipt message types. It addresses the fact that 32% of MCP servers have critical vulnerabilities.

How does Authensor compare to Galileo Agent Control or NeMo Guardrails?

Authensor is the only open-source framework that provides all four pillars: tool permissions, approval workflows, cryptographic audit trails, and content safety scanning. Galileo Agent Control (Apache 2.0) provides evaluation but lacks approval workflows and receipts. NeMo Guardrails focuses on conversational safety but not tool authorization. AWS AgentCore uses Cedar policies but is AWS-locked. Authensor is cloud-agnostic, self-hostable, and MIT licensed with 924+ tests.

What AI agent frameworks does Authensor integrate with?

Authensor has official adapters for LangChain/LangGraph, OpenAI Agents SDK, Vercel AI SDK, Claude Agent SDK, and CrewAI. It also integrates with Claude Code via hooks and any MCP server via the MCP Gateway. TypeScript and Python SDKs support any custom agent framework.

Why Agent Safety Should Be Free

AI agents are shipping to production faster than safety tooling can keep up. The market response has been predictable: enterprise vendors charging per-request fees, requiring sales calls for pricing, or locking critical safety features behind paid tiers.

We think that's backwards. Agent safety is infrastructure. It should be as free and available as HTTPS.

What Enterprise Agent Safety Costs Today

The agent safety landscape in 2026 looks like this:

Per-request pricing: AWS AgentCore charges $0.000025 per authorization request. That's $12.50/month at 500K requests — reasonable until you're running at scale.
Enterprise contracts: Most standalone safety platforms (now acquired by Cisco, Palo Alto, Check Point, Snyk) require enterprise licensing. $10K–$100K/year is typical.
Partial stacks: Open-source tools like NeMo Guardrails and Guardrails AI cover content safety but not action authorization, approval workflows, or audit trails. You end up stitching together 3–4 tools.
Vendor lock-in: AWS-specific, framework-specific, or model-specific solutions that don't work across your stack.

What Authensor Gives You for Free

Everything. The full stack. MIT licensed. Self-hostable.

| Capability | What it does | What you'd pay elsewhere | |---|---|---| | Policy Engine | Declarative YAML rules, fail-closed default, priority-based evaluation | $0.000025/req (AWS) or enterprise contract | | Approval Workflows | Pause agent actions, route to humans via Slack/email/SMS, multi-party quorum | Custom build ($50K+ eng time) | | Cryptographic Audit Trail | SHA-256 hash-chained receipts, tamper-evident, Sigstore integration | Doesn't exist in any other tool | | Content Scanner (Aegis) | Prompt injection, PII, credentials, memory poisoning, code safety — zero dependencies | $10K+/yr (standalone scanners) | | Anomaly Detection (Sentinel) | EWMA/CUSUM per-agent baselines, behavioral drift detection | $15K+/yr (observability platforms) | | MCP Tool Governance | Gateway proxy for MCP servers, per-tool authorization | Doesn't exist elsewhere | | Budget Enforcement | Per-principal spending limits, daily/weekly/monthly resets | Custom build | | Session Threat Detection | Multi-action pattern detection, forbidden sequences | Custom build | | 8 Framework Adapters | LangChain, OpenAI, CrewAI, Claude, Vercel AI SDK, MCP, TS SDK, Python SDK | Framework-specific, if available |

Self-hosted: free, forever. Hosted tier: $5/month. No per-request fees. No usage limits.

Why Free?

Three reasons.

1. Safety shouldn't have a paywall. The more agents that run with policy enforcement and audit trails, the safer the ecosystem gets for everyone. Charging enterprise prices for basic safety tooling means most agents ship without it.

2. The moat isn't the code. Our value comes from operational convenience (hosted tier), threat intelligence (federated detection across deployments), and ecosystem effects (more adapters, more policy templates, more community). The code itself should be open.

3. EU AI Act creates universal demand. The August 2026 deadline for high-risk AI systems means every organization deploying agents needs audit trails (Article 12), human oversight (Article 14), and risk management (Article 9). Making these capabilities free accelerates compliance across the industry.

OWASP Agentic Top 10 Coverage

Authensor covers all 10 OWASP Agentic risks with dedicated features:

| Risk | Authensor Feature | |---|---| | ASI01: Agent Goal Hijacking | Aegis injection detection + fail-closed policy | | ASI02: Tool Misuse | Per-tool policies + constraints + budget limits | | ASI03: Identity & Privilege Abuse | Principal binding + RBAC + session scoring | | ASI04: Supply Chain Vulnerabilities | MCP Gateway + domain allowlisting | | ASI05: Unexpected Code Execution | Deny-by-default + Aegis code-safety rules | | ASI06: Memory Poisoning | 22 MINJA-informed Aegis rules + hash-chained receipts | | ASI07: Insecure Inter-Agent Comms | Chain tracing + depth alerts | | ASI08: Cascading Failures | Sentinel anomaly detection + kill switch | | ASI09: Human-Agent Trust Exploitation | Approval workflows + TOCTOU re-evaluation | | ASI10: Rogue Agents | Sentinel behavioral baselines + forbidden sequences |

Most enterprise tools cover 3–4 of these risks. Content safety tools cover injection and PII but not authorization or approval workflows. Cloud-specific tools cover policy enforcement but not content scanning or anomaly detection.

Getting Started

npx @authensor/create-authensor my-agent
cd my-agent && npm install && npm run demo

The demo shows an unprotected agent executing 6 actions (including destructive ones), then the same agent with Authensor blocking the dangerous actions and flagging one for human approval. The full audit trail is displayed as a hash-chained receipt table.

Self-host the control plane:

git clone https://github.com/authensor/authensor.git
cd authensor && docker compose up -d

That gives you PostgreSQL, the control plane API, Aegis scanning, Sentinel monitoring, approval workflows, and cryptographic receipts. Running on your infrastructure. Free.

Authensor is MIT licensed. Every line of safety code is open source. We believe the barrier to agent safety should be npm install, not a procurement process.