Guard — Agent Runtime Security

npm install @safepaste/guard @safepaste/core

var { createGuard } = require('@safepaste/guard');

// 1. Create a guard instance
var guard = createGuard({ mode: 'block' });

// 2. Wrap your tool function
var safeSearch = guard.wrapTool('web_search', searchFn);

// 3. Handle blocked attacks
try {
  var result = await safeSearch('latest news');
} catch (e) {
  if (e.name === 'GuardError') {
    console.log('Blocked:', e.guardResult.scan.risk);
  }
}

var guard = createGuard({
  mode: { input: 'warn', output: 'block' }
});

var guard = createGuard({
  mode: function (guardResult) {
    if (guardResult.scan.score > 80) {
      return false; // block high-confidence attacks
    }
    sendToReviewQueue(guardResult); // log medium-confidence for review
  }
});

var safeSearch = guard.wrapTool('web_search', searchFn);
var safeRead = guard.wrapTool('file_read', readFileFn);

// Wrapped functions have the same signature as the originals
var results = await safeSearch('query');
var content = await safeRead('/path/to/file.txt');

var tools = {
  web_search: searchFn,
  file_read: readFileFn,
  code_exec: execFn
};

var safeTools = guard.wrapTools(tools);
// safeTools.web_search, safeTools.file_read, safeTools.code_exec are all guarded

// Scan tool input manually
var inputResult = guard.scanInput(userQuery, { tool: 'web_search' });

// Scan tool output manually
var outputResult = guard.scanOutput(webPageContent, { tool: 'web_search' });

if (outputResult.flagged) {
  console.log('Attack detected in output:', outputResult.scan.risk);
}

var { scanToolInput, scanToolOutput } = require('@safepaste/guard');

var result = scanToolInput(text, { tool: 'web_search', strict: true });
if (result.flagged) {
  // handle it your way
}

try {
  var result = await safeTool(input);
} catch (e) {
  if (e.name === 'GuardError') {
    // e.message    — Human-readable description of what was blocked
    // e.name       — Always 'GuardError'
    // e.guardResult — Full GuardResult object (see table above)

    console.log(e.message);
    // "Prompt injection blocked in output (web_search) — risk: high, score: 82"

    console.log(e.guardResult.scan.matches);
    // [{ category: 'instruction_override', pattern: '...', weight: 35 }]

    console.log(e.guardResult.guard.tool);
    // 'web_search'
  }
}

var { createGuard } = require('@safepaste/guard');
var OpenAI = require('openai');

var client = new OpenAI();
var guard = createGuard({ mode: 'block' });

// Your tool implementations
var tools = {
  web_search: async function (query) { /* ... */ },
  read_file: async function (path) { /* ... */ }
};

// Wrap all tools
var safeTools = guard.wrapTools(tools);

// In your function-calling loop:
for (var call of toolCalls) {
  try {
    var result = await safeTools[call.function.name](
      JSON.parse(call.function.arguments)
    );
  } catch (e) {
    if (e.name === 'GuardError') {
      result = { error: 'Tool blocked: prompt injection detected' };
    }
  }
}

var { createGuard } = require('@safepaste/guard');
var { tool } = require('ai');
var { z } = require('zod');

var guard = createGuard({ mode: 'block' });

var searchTool = tool({
  description: 'Search the web',
  parameters: z.object({ query: z.string() }),
  execute: guard.wrapTool('web_search', async function ({ query }) {
    // Your search implementation
    return await fetchSearchResults(query);
  })
});

var { createGuard } = require('@safepaste/guard');
var { DynamicTool } = require('@langchain/core/tools');

var guard = createGuard({ mode: 'block' });

var searchTool = new DynamicTool({
  name: 'web_search',
  description: 'Search the web for information',
  func: guard.wrapTool('web_search', async function (query) {
    // Your search implementation
    return await fetchSearchResults(query);
  })
});

var { createGuard } = require('@safepaste/guard');

var guard = createGuard({
  mode: { input: 'warn', output: 'block' },
  on: {
    detection: function (r) { logToMonitoring(r); },
    blocked: function (r) { alertOps(r); }
  }
});

async function agentLoop(messages) {
  while (true) {
    var response = await llm.chat(messages);
    if (!response.toolCall) break;

    // Scan the input the agent is sending to the tool
    guard.scanInput(response.toolCall.args, {
      tool: response.toolCall.name
    });

    // Execute the tool
    var toolResult = await executeTool(response.toolCall);

    // Scan the output coming back from the tool
    try {
      guard.scanOutput(toolResult, {
        tool: response.toolCall.name
      });
    } catch (e) {
      if (e.name === 'GuardError') {
        toolResult = '[blocked: injection detected in tool output]';
      }
    }

    messages.push({ role: 'tool', content: toolResult });
  }
}

var guard = createGuard({
  mode: 'block',
  on: {
    error: function (err, ctx) {
      // Scanning failed — tool still executes
      console.error('Guard scan error on', ctx.tool, ctx.point, err);
      metrics.increment('guard.scan_error');
    }
  }
});