agentshield
Installation
SKILL.md
AgentShield
AI Agent Detection & Response (AADR) — real-time security monitoring with Sigma rules and LLM-powered triage.
What is AgentShield?
AgentShield is a Go security engine that monitors AI agent tool calls in real-time. It evaluates each call against Sigma security rules and optionally routes suspicious events through LLM triage for context-aware verdicts. It runs as a single binary with no external runtime dependencies.
Architecture
Single Go binary (agentshield) containing:
- HTTP server (Chi router,
127.0.0.1:8433by default) - Sigma rule engine (forked sigmalite in
pkg/sigma/) - SQLite alert/feedback store
- LLM triage (OpenAI or Anthropic provider, optional)
- Bearer token authentication (constant-time comparison)
- Per-IP rate limiting (~100 req/min, burst 10)
One systemd user service: agentshield-engine.service (Linux) or one launchd agent: ai.agentshield.engine (macOS).