AI Agent Lens documentation
AI Agent Lens is runtime security and governance for the AI agents already running inside your company. It has two parts:
- AgentShield is an open-source gate that runs on each machine. It checks every shell command and MCP tool call an agent wants to make, before it runs, and answers block, audit or allow. It runs in under 30 ms and never calls home.
- AI Agent Lens is the control plane. It pushes your policy to every agent, collects every decision into one tamper-evident audit trail, and maps the result to the controls in SOC 2, ISO 27001, ISO 42001, the EU AI Act, OWASP, MITRE ATLAS, GDPR and HIPAA.
Governance, in two sentences: you can say what your agents did, and you can stop the things they should not do.
What you can do
- Gate destructive commands, credential reads, pipe-to-shell, exfiltration chains and poisoned MCP tool descriptions on every developer machine, deterministically.
- Observe every decision from every agent in the organisation in one audit log, with the command, the rule that fired and the reason.
- Roll out safely with audit-only mode: nothing is blocked until you decide, and you can see exactly what would have been.
- Prove which compliance controls are exercised by real agent activity, and export the evidence for an auditor.
- Keep data in with customer-defined labels that stop PII, secrets and internal identifiers leaving through agents or MCP tools.
Choose where to start
| You want to | Read |
|---|---|
| Protect your own machine in two minutes | Getting started |
| Roll AgentShield out to a team and see the audit trail | Platform handbook |
| Write your own rules or understand the analyzer | Policy authoring guide |
| Put AgentShield in front of a production agent or MCP server | MCP mediation, Agents in CI |
| Integrate with the API | API overview |
Works with
Claude Code, Cursor, Windsurf, Codex CLI, Gemini CLI, OpenClaw, any MCP server, and LangChain or custom agents through the CLI. See Agent and IDE integration.