OPEN SOURCE · RUNS LOCALLY · <1MS INLINE

Every action looks normal.
The trajectory doesn't.

Tack builds each agent's baseline from its own tool calls and scores how far a new call deviates, catching credential-creep and anomalies that stateless policies miss. Contain threats inline: warn, block, or quarantine.

agent.ts

$ npm install @tacksec/guard

import { createGuard } from '@tacksec/guard'
const guard = createGuard({ mode: 'enforce' }) // advisory by default

// score every tool call · 0 → 1 · locally
const { score, verdict } = guard.evaluate(toolCall)
if (verdict === 'quarantine') block()

Start free Read the docs

AGENT sales-bot · HEADING 047°

Slow privilege escalation across many calls

ALIGNED WITH
OWASP LLM Top 10
OWASP Agentic Top 10
MITRE ATLAS
NIST AI RMF

Runs locally
Zero dependencies
Your data never leaves your app

THE BLIND SPOT

Stateless security can't see the slow attack coming.

Every tool out there does binary allow or block. Each call is judged alone, so the attack that unfolds across calls walks straight through.

AGENT TIMELINE

read ok ✓
read ok ✓
write ok ✓
read ok ✓
write ok ✓
sensitive ok ✓
admin ok ✓

Each action looks fine. Only the trajectory reveals the threat.

CRITICAL

credential-creep

The slow attack. Read-only baseline, then writes, then sensitive data. Each step looks harmless.
CRITICAL

smash-and-grab

The loud attack. Bulk export, mass delete, exfiltration. Obvious but still needs catching.
HIGH

behavioral-drift

The weird attack. After-hours access, volume spikes, admin attempts. Doesn't match any known pattern.

HOW IT WORKS

Three beats, every tool call.

One inline loop wraps every action your agent takes. Tack tracks, scores, and contains, before the call ever runs.

01

Learn the baseline

Tack observes the first N calls and builds a per-agent baseline of what "normal" looks like for each agent.
02

Score every action

Each subsequent tool call is scored 0 → 1 against the baseline. Eight weighted signals, combined into a risk score.
- escalation_trajectory
- sensitive_write
- sensitive_egress
- volume_spike
- rapid_burst
- new_write_access
- after_hours
- admin_attempt
03

Contain inline

Warn, block, or quarantine. In under a millisecond. Before the action executes.

WHO IT'S FOR

Honest about where this fits.

tack-guard is a focused guard under the agent stack, not the whole platform — not a one-size guardrail. Here is exactly who tack-guard v0.2 is for today, and where it is not the fit yet, or where you should pair it.

BUILT FOR YOU IF

You run a susceptible model

gpt-4o-mini, Llama, Qwen, DeepSeek, Kimi, and friends, not only Claude, which largely self-resists. The guard concentrates its value on models that can be talked into the wrong tool call.
Your agent holds high-impact tools

It can exfiltrate, delete, transfer funds, or escalate privilege. When a single tool call can do real damage, a deterministic backstop on every call earns its place.
You want a deterministic, free backstop

A ~3µs check on every tool call, scored 0 to 1, MIT-licensed, zero runtime dependencies, running locally under the agent. No model in the loop to talk around.
You want to observe first, enforce later

Start in score-only or warn mode to learn what your agents actually do, then turn on enforcement once you trust the baseline. Adopt without breaking production on day one.

NOT THE FIT YET — OR PAIR IT

You need injection-text defense

tack-guard scores behavior, not prose. Pair it with a prompt firewall for the injection-text layer; the two sit at different points in the stack and complement each other.
Frontier-aligned model, low-stakes tools

A capable, well-aligned model with only read-only or harmless tools already self-defends. The backstop is real but the marginal safety it adds here is small.
You want a full platform or SOC

Dashboards, persistent cross-session baselines, alerts, and forensics are Tack Cloud, coming soon. The free guard is the local layer, not the whole platform.
You run a policy/identity platform

tack-guard is a narrow, deterministic, JS-native guard that complements policy/identity platforms like Microsoft's Agent Governance Toolkit — not a replacement for one. Pair the two: they sit at different layers.

TRY IT NOW

Add runtime security in 5 lines.

Drop it into your tool-call pipeline. It scores locally, returns instantly, and never phones home.

Works with

LangChain ·OpenAI ·Anthropic ·MCP ·any agent framework

Read the docs

guard.ts

import { createGuard } from '@tacksec/guard'

const guard = createGuard({
  sensitiveTargets: ['user_db', 'credentials', 'billing'],
  mode: 'enforce'
})

// wrap your agent's tool calls
const result = guard.evaluate({
  agentId: 'sales-bot',
  action: 'read',
  target: 'user_db',
  hour: 14
})

if (result.blocked) {
  console.warn(`Blocked: ${result.pattern} (score: ${result.score})`)
}

FREE VS CLOUD

Start free. Scale with Cloud.

The guard is free forever. Cloud adds the memory that survives restarts and correlates behavior across sessions.

tack-guard

FREE · MIT

The open-source SDK. Drops into any agent, scores every call locally.

Scoring engine (8 signals, 0 → 1)
Pattern detection (4 attack types)
Stateless signatures
Multi-agent isolation
Zero dependencies, <1ms
MIT open source

Tack Cloud

PAID

Hosted memory and correlation. The fleet view across every session.

Everything in tack-guard, plus:

Persistent memory (baselines survive restarts)
Cross-session detection (24h, 72h, 7d patterns)
Cross-agent baselines (catch agentId splitting)
Dashboard & timeline coming soon
Alerts (email, webhook, Slack) coming soon
LLM-powered analysis coming soon

WHY MEMORY WINS

Policy engines check rules. Tack remembers behavior.

Rules catch what you already named. A per-agent baseline catches the escalation no one wrote a rule for.

Approach	Detects loud attacks	Detects slow escalation	Remembers history	Inline (<1ms)
Policy engine	yes	no	no	yes
Proxy / WAF	yes	no	no	partial
Log monitoring	yes	post-mortem	no	no
tack-guard	yes	yes	yes	yes

✓ yes ✗ no ~ △ partial

See how it scores on the benchmarks

WHO'S BUILDING THIS

Built in the open, by someone who breaks agents for a living.

Damien Aubry

Technical founder · San Francisco

French founder building in San Francisco. Built Tack's scoring engine live at the Agent Native Company Hackathon (Beta x Nebius) in Sunnyvale, then open-sourced it as tack-guard. Breaking AI agents to learn how to defend them.

Origin: Agent Native Company Hackathon (Beta x Nebius), Sunnyvale, June 2026

SIGNAL, NOT NOISE

tack-guard ships under the MIT license. The scoring engine, the detection rules, and this site are all public. Read the code, run it locally, and judge the behavior for yourself. No telemetry, no signup to try it.

Star on GitHub Read the docs

[>] Built live at the hackathon, then open-sourced
[>] MIT licensed · runs on your machine
[>] Issues and PRs welcome on GitHub

SHIP WITH A BASELINE

Secure your agents before they drift.

Open source. Runs locally. Five lines to your first risk score.

Start free Read the docs

Every action looks normal. The trajectory doesn't.

credential-creep

smash-and-grab

behavioral-drift

Learn the baseline

Score every action

Contain inline

You run a susceptible model

Your agent holds high-impact tools

You want a deterministic, free backstop

You want to observe first, enforce later

You need injection-text defense

Frontier-aligned model, low-stakes tools

You want a full platform or SOC

You run a policy/identity platform