Guard every tool call your agent makes.

Install

tack-guard ships as a single zero-dependency package on npm. It is written in TypeScript, ships both ESM and CommonJS builds with bundled types, and runs on Node 18 or newer.

• Zero runtime dependencies
• ~17KB bundle
• evaluate() under 1ms
• ESM + CJS, typed
• MIT licensed

Quick start

Create a guard once, then evaluate each tool call before you run it. Every call returns a graded verdict; you skip the tool whenever result.blocked is true and hand the summary back to the model.

import { createGuard } from '@tacksec/guard'

const guard = createGuard()

// Inside your agent's tool-execution pipeline:
const result = guard.evaluate({
  action: 'write',
  target: 'user_db.credentials',
})

if (result.blocked) {
  // Skip the tool call and return result.summary to the model.
} else {
  // Run the tool.
}

A blocked, escalating call returns a fully explained result:

{
  verdict: 'quarantine',
  score: 0.57,
  severity: 'CRITICAL',
  pattern: 'credential-creep',
  signals: { escalation_trajectory: true, new_write_access: true, sensitive_write: true }, // plus the other 5 signals, all false
  evidence: [
    'access to sensitive target: user_db.credentials',
    'trajectory: read-only -> mutate -> sensitive/admin over 3d',
  ],
  summary: 'Agent escalated from read-only to sensitive access. Credential-creep detected.',
  quarantined: true,
  blocked: true,
}

How scoring works

Two complementary layers run on every call. The score is the weighted sum of the signals that fired, clamped to 0 to 1: it grades with the evidence, it is not a hardcoded constant.

The eight weighted signals

Each signal contributes its weight when it fires. Override any of them with the weights config.

The four attack patterns

Map your tool calls

The one catch with { action, target } is mapping your real tool calls onto it. tack-guard does that for you, so synonyms and casing cannot slip past a literal string check.

Infer from a provider tool call. OpenAI and Anthropic function-calling, the Vercel AI SDK, and MCP all emit { name, arguments }. inferToolCall maps the tool name to an action and the arguments to a target.

import { createGuard, inferToolCall } from '@tacksec/guard'

const guard = createGuard()

for (const call of response.tool_calls) {
  const verdict = guard.evaluate(inferToolCall(call))
  if (verdict.blocked) continue // Skip the tool, return the refusal to the model.
  runTool(call)
}

Or wrap a tool once and forget about it. A blocked call does not run: it throws GuardBlockedError, or calls your onBlocked handler.

const safeQuery = guard.wrapTool(db.query, {
  action: 'read',
  target: (sql) => (sql.includes('credentials') ? 'user_db.credentials' : 'db'),
})

await safeQuery('SELECT ...') // Throws GuardBlockedError if the guard blocks it.

Under the hood, canonicalizeAction folds any verb or tool name into six classes: read, write, admin, exfiltrate, destroy, and other. It is deliberately conservative, so an email or upload agent is not quarantined for doing its job.

API reference

createGuard(config?)

Creates a guard. Every option is optional; the defaults are safe for most agents.

const guard = createGuard({
  sensitiveTargets: ['payments', 'api_keys', 'credentials'], // string[] or predicate
  egressTargets: ['mycorp.com'],   // opt-in allowlist of trusted destinations
  businessHours: [9, 18],          // [start, end), default [9, 18)
  mode: 'warn',                    // 'warn' (default, advisory) | 'enforce' | 'score-only'
  baselineMin: 5,                  // calls before a baseline is established
  detectionThreshold: 0.5,         // score below this is no detection
  weights: { rapid_burst: 0.2 },   // partial override of signal weights
})

guard.evaluate(call)

Scores a single tool call synchronously and returns a GuardResult. This is the hot path: no model, no network.

const result = guard.evaluate({
  action: 'update_row',        // any string, canonicalized internally
  target: 'user_db.accounts',  // what it is touching
  agentId: 'sales-bot',        // optional, default 'default'
  hour: 14,                    // optional, default current hour
  at: 1718000000000,           // optional epoch ms, default now
})

Input: the ToolCall fields.

Returns: a GuardResult.

guard.evaluateAsync(call)

Same as evaluate(), but awaits an asynchronous MemoryClient (Redis, a network DB, a cloud store). Scoring stays synchronous and local; only the memory I/O is awaited. evaluate() throws on an async client rather than silently degrading.

guard.wrapTool(fn, opts)

Wraps a tool so every call is evaluated first; blocked calls do not run. action and target can be static or functions of the args. It is synchronous, so a blocked call throws synchronously: use try / catch, not .catch(). Pass onBlocked to handle a block without throwing.

inferToolCall(rawToolCall, overrides?)

Maps a provider { name, arguments } tool call to a ToolCall. The action comes from the tool name (canonicalized), the target from the arguments. Override either explicitly.

canonicalizeAction(raw)

Folds any verb or tool name into one of six canonical classes: read, write, admin, exfiltrate, destroy, other. Case and synonym aware.

guard.connect(apiKey) roadmap

Persistent, cross-session baselines via one line. Not yet implemented: it throws until Tack Cloud ships. The local guard works fully standalone today.

guard.reset() · setMemory() · getAgentState()

reset(agentId?) clears state, setMemory(client) plugs in a custom backend, and getAgentState(agentId) inspects an agent.

Exported constants and types

For advanced tuning, tack-guard exports WEIGHTS, BASELINE_MIN, DETECTION_THRESHOLD and the SignalName type, plus the Verdict, Severity, Pattern, ToolCall, GuardResult, GuardConfig and MemoryClient types.

Modes

mode sets the verdict policy. Start in score-only or warn to observe your traffic, then switch to enforce once the numbers look right for you.

Custom memory

The default in-memory client loses baselines on restart, by design. Implement the four-method MemoryClient interface to back it with your own store. Synchronous backends (an in-process cache, better-sqlite3) use evaluate(); async backends (Redis, a network DB) use evaluateAsync().

import { createGuard, type MemoryClient } from '@tacksec/guard'

class RedisMemory implements MemoryClient {
  async push(agentId, event) { /* ... */ }
  async getEvents(agentId) { /* returns Promise<StoredEvent[]> */ }
  async clear(agentId) { /* ... */ }
  async clearAll() { /* ... */ }
}

const guard = createGuard()
guard.setMemory(new RedisMemory())
await guard.evaluateAsync({ action: 'write', target: 'users' })

Persistent, cross-session baselines that survive restarts are Tack Cloud's job, exposed through guard.connect().

Reference: verdicts and severity

Every result carries a verdict and a severity.

Severity is one of LOW, MEDIUM, HIGH, CRITICAL, scaled with the score.

Limitations and threat model

tack-guard advises; your pipeline enforces. It returns a verdict, and you must actually skip the blocked tool call. It is a fast heuristic layer, not a complete defense. The honest limits, by design:

• Sensitivity is name-based. Targets are matched by substring (or your sensitiveTargets), so a destructive op on an innocuously named table can be missed, and a benign write to a user_db.* table can over-flag. Pass a predicate for precision.
• Behavioral detection needs a read-only baseline. An agent that mutates from call one has no normal to deviate from; it relies on the signature layer.
• Single session only. Baselines live in memory and reset on restart. Multi-day, cross-session correlation is Tack Cloud.
• Not a prompt-injection filter. It scores behavior, what the agent did, not prompt content. Use it alongside input and output guards.

FAQ

Does tack-guard call an LLM?

No. Scoring is deterministic heuristics plus a per-agent baseline. There is no model and no network call in the hot path, so the verdict is reproducible and explainable.

How fast is it?

Inline and synchronous, under 1 millisecond. tack-guard has zero runtime dependencies and a bundle of roughly 17KB.

Does it stop prompt injection?

Not directly. tack-guard scores the action an agent takes, not the prompt text. Run it alongside an input or output prompt guard for defense in depth.

Is it free?

Yes. tack-guard is MIT licensed and runs locally. Persistent, cross-session baselines and dashboards are the paid Tack Cloud tier.

Does it need training data?

No. It builds each agent's baseline live from the first few calls (baselineMin, default 5). The stateless signature layer still catches blatant attacks on call one.