Why SHAI exists

Agents are not chatbots anymore. They are execution systems.

Agents don't just answer questions anymore. They write code, send email, deploy infrastructure, move money. Every new tool you connect widens the attack surface — and unlike a traditional app, the surface grows automatically as the agent reasons about what to do next.

That's a fundamentally new security shape. A web app has a fixed set of endpoints. An agent has whatever endpoints its tools expose, called in whatever order the model decides, with whatever arguments the model constructs. The old defenses don't fit.

Existing tools help but leave the biggest gap open. Text classifiers scan what goes into the LLM and what comes out. They don't govern the tool calls in between — which is exactly where an autonomous agent turns from a chatbot into a system that can do damage.

SHAI lives in that gap.

SHAI is not an agent, it's the security harness that wraps around one. You keep building with whatever framework you use — LangChain, LangGraph, CrewAI, Anthropic SDK, or a custom loop. SHAI sits between the agent and its tools, mapped against every threat on the OWASP Agentic AI Top 10, and honest about what it fully catches and what it only partially catches (see coverage below).

The Secure harness

The harness around the agent loop.

A guardrail scans text. A harness governs actions. SHAI is the second thing. Keep whatever framework the agent already uses — LangChain, LangGraph, CrewAI, PydanticAI, the Anthropic SDK, or a custom loop. SHAI sits between the agent and its tools and enforces what's allowed at each boundary.

The idea

Every agent follows the same shape: user sends a message → LLM reasons → LLM calls a tool → tool returns a result → LLM responds.

SHAI places a deterministic check at each of those transitions — before the LLM reads the input, before the tool runs, after the tool returns, and before the response reaches the user. Each check emits one signed audit event.

The architecture

Works with the frameworks people already use

Nothing to rebuild. SHAI ships with integrations for
LangGraph LangChain CrewAI Anthropic SDK PydanticAI OpenAI Agents

An existing agent can pick SHAI up without rewriting the loop logic.

Goal & instruction hijacking

Partial

Two independent intercepts — before the LLM and at the tool gate.

17 rules catch instruction overrides, role spoofing, and delimiter smuggling before a single token is processed. If anything slips through, the L1 gate blocks any undeclared tool from firing.

Tool misuse

Full

Seven-layer gate on every tool call, no exceptions.

Allowlist → argument rules → irreversibility → capability tags → policy intersection → cross-boundary signal correlation → argument scan. Every layer must pass before any tool fires.

Uncontrolled agent actions

Full

Every agent operates inside an explicit capability envelope it cannot escape.

Subagents inherit a scoped subset of their parent's permissions — read-only stays read-only, no matter what the LLM requests.

Resource overload

Full

Rate limits, session budgets, and loop detection on every tool call.

Sliding-window rate limits per agent and per tool, cumulative session budgets, and fingerprint-based loop detection keep runaway loops from doing real damage. Enforced per SHAI instance; distributed deployments use the shared-state backend.

Direct prompt injection

Partial

scan_input intercepts attacks before the LLM sees them.

17 rules covering jailbreaks, encoded payloads, homoglyph obfuscation, and tool coercion — configurable threshold per boundary. Regex catalogs are a strong first line, not a complete defence: novel or semantic attacks may pass. Ensemble scoring, heuristic detection, and the signed pattern DB close the gap over time.

Indirect prompt injection

Partial

scan_tool_result stops poisoned tool output before it re-enters context.

The checkpoint most harnesses miss. Every document, search result, and API payload is scanned with a document-tuned catalog before the LLM ingests it. Same catalog-visibility limit as direct injection: crafted payloads may still pass. Cross-boundary correlation tightens the tool gate when input already showed signs of attack.

Repudiation & untraceability

Full

Every boundary leaves one structured, signed audit event.

HMAC-SHA256 signed, SIEM-ready, scrubbed of raw content. A complete step-by-step record of what the agent did and why.

Privilege escalation

Full

Subagents cannot reach beyond the scope they were explicitly given.

Least privilege enforced deterministically at dispatch time.

Sensitive data exposure

Full

PII scanning at three independent checkpoints — input, tool arguments, and output.

Emails, phones, SSNs, credit cards — detected, redacted, never logged. Block, alert, or scrub in-place per boundary.

Data exfiltration

Partial

scan_output checks the agent's response before it reaches the user; network-layer enforcement stops unauthorized outbound calls at the wire.

Catches credentials that slipped into the narrative. Every allowed MCP call carries a signed DispatchToken; ShaiTransport validates URL, method, and source binding on every request. Non-MCP tool traffic still needs infrastructure-layer egress controls.

Supply chain compromise

Partial

MCP servers, plugins, and integrations are gated before activation.

Untrusted sources are suppressed. Secrets live behind secret:// URIs — never hardcoded, never logged.

This is not generic AI safety language. Every entry above is an executable control mapped to a concrete threat, with the status the code actually earns — full where the mechanism is deterministic and complete, partial where residual risk remains and we say so. Threats outside SHAI's scope — model alignment, human oversight, infrastructure egress — are not listed here because SHAI does not solve them alone. See the threat model for the full picture.

Get started

Wire SHAI into an existing agent in minutes.

Pick a template. Add SHAI to the loop. The agent stays as it is — the boundaries wrap the tool calls.

The docs ship as a set of skills that can be queried interactively for anything the templates don't cover.

quickstart

Differentiation

How SHAI is different from LLM guardrails

The security surface of a production agent has several distinct problems: is the user input hostile, is the LLM about to call a tool it shouldn't, is the tool result carrying instructions the LLM will treat as authoritative, is the response leaking data, is the whole session drifting adversarially over multiple turns.

LLM guardrails — Guardrails AI, NeMo, LlamaFirewall, Rebuff, Lakera — validate LLM inputs and outputs. They classify text. Useful, and complementary to SHAI. They do not gate tool calls, scan tool results, enforce per-agent capability scoping, or emit a signed audit trail.

SHAI treats the whole agent lifecycle as the unit of enforcement.

Deterministic policy-based tool-call gate. Seven layers of check between the LLM proposing a tool call and the tool running — allowed-tool set, argument rules, irreversibility, subagent capability scope, policy intersection, cross-boundary signal correlation, optional argument scanning. Code, not LLM judgement.

Tool-result scanning as a first-class boundary. Where indirect prompt injection lives — and most other tools miss it entirely.

Cross-boundary signal correlation. An input flagged for injection tightens the gate on the tool call that follows.

Cross-turn threat accumulation. Adversarial patterns that stay under any single turn's threshold get caught at the session level.

Signed, tamper-evident audit trail. HMAC-SHA256 over every event.

Prompt injection defence is one of the things a harness has to do. It is not the whole job.

SHAI

An independent open-source project. No managed service, no sign-up, no keys. Brought to you by AIBestLabs.

Architecture OWASP Coverage Get Started Docs GitHub

Discover more with AI: talk with the documentation!

👋 Your feedback shapes it.

Agents are not chatbots anymore. They are execution systems.

SHAI lives in that gap.

The harness around the agent loop.

The idea

The architecture

Works with the frameworks people already use

Built around OWASP Agentic AI Threats by design.

Goal & instruction hijacking

Tool misuse

Uncontrolled agent actions

Resource overload

Direct prompt injection

Indirect prompt injection

Repudiation & untraceability

Privilege escalation

Sensitive data exposure

Data exfiltration

Supply chain compromise

Wire SHAI into an existing agent in minutes.

LangGraph

LangChain · CrewAI

Anthropic SDK

PydanticAI

OpenAI Agents

Custom loop

How SHAI is different from LLM guardrails