A New Approach to AI Agent Security: Aegotrax, the Open-Source Tool Call Interceptor

The Real Risk in AI Agents Happens at the Moment of a Tool Call

As AI agents grow more capable, security concerns are rapidly moving from theory to reality. A developer recently shared on Reddit an open-source security project they're building, targeting an attack surface many overlook: the moment an agent invokes a tool.

The observation is sharp — real damage doesn't happen when the model is "thinking." It happens when the agent actually takes action: making HTTP requests, sending emails, querying databases, reading and writing files. A hidden instruction buried in a document can trick an agent into doing something the user never asked for — and from a system perspective, it still looks like a perfectly normal tool call.

This is precisely what makes prompt injection attacks so dangerous: malicious intent is packaged as a legitimate operation, bypassing traditional input filtering. The developer built a small open-source pilot project called Aegotrax specifically to defend against this "moment of execution."

What Aegotrax Does

Unlike common prompt-filtering approaches, Aegotrax places its defense at the gate just before a tool call is executed. The core logic can be summarized in four steps:

• Intercept tool calls: capture them before they actually execute
• Check intent + data provenance + policy: combine lightweight data provenance tracking with policy rules to make a judgment
• Return an ALLOW / BLOCK decision: with a clear rationale attached
• Write to an audit log: maintain a traceable record of every action

This "inspect before allowing" model essentially inserts a programmable security gate between the agent and the outside world. Compared to intercepting text only at the input layer, it operates closer to the action layer where real harm occurs — and is theoretically capable of catching calls that "look normal but exceed authorization."

Technology Stack

The implementation is intentionally lightweight and easy to run locally:

• Risk engine: built on FastAPI, runs on localhost
• Python SDK: offers both a verify_tool_call function and a decorator interface
• Optional MCP gateway: accessible via stdio
• Deployment: supports Docker or pip

Notably, the project supports the MCP (Model Context Protocol) gateway. As MCP gradually becomes the standard protocol for agents to connect with tools, implementing security interception at this layer means the solution can potentially cover a much broader agent ecosystem — not just a single framework.

What is MCP? MCP (Model Context Protocol) is an open protocol proposed by Anthropic in late 2024, designed to establish a unified standard for communication between AI agents and external tools or data sources. Think of it as "the USB port of the agent world": tool developers implement an MCP server once, and any MCP-compatible agent framework can plug right in without custom adapters. MCP transmits structured tool descriptions, call requests, and responses via stdio or HTTP streaming, standardizing tool discovery and invocation. Claude and several open-source frameworks (including experimental branches of LangChain and AutoGen) have already added MCP support. Aegotrax's design of applying security interception at the MCP gateway layer means that as long as an agent framework uses the MCP protocol, it can be universally protected — no need to integrate the SDK separately for each framework. This is highly practical in today's multi-framework ecosystem.

The Author's Candor: What It Is Not

One of the most commendable aspects of this project is the author's clear articulation of its boundaries. They explicitly state what Aegotrax is not:

• Not a prompt filter
• Not a production-grade or enterprise-grade security product
• Not a transparent proxy solution for all existing enterprise agents
• Policies are heuristic-based — they require tuning, and cannot block all attacks

This kind of self-limitation is especially valuable in the security domain. AI agent security is still in its early exploratory phase, and any claim of "comprehensive protection" should be treated with skepticism. By positioning Aegotrax as an open pilot and a locally sandboxable prototype — not a turnkey solution — the author is being honest about where the technology actually stands.

The limitations of heuristic policies are also very real: they depend on the breadth of the rules, and may fall short against attack patterns they've never encountered. This explains why the author is eager for community feedback — security rules need to be continuously refined through real-world scenarios.

What are heuristic policies? Heuristic strategies make decisions based on empirical rules rather than rigorous mathematical proof. In security, typical heuristic rules look like: "block if the tool call target domain isn't on the allowlist" or "alert if a single call involves data exceeding a volume threshold." The upside is that they're interpretable and fast to deploy. The downside is that their coverage is limited by the rule authors' experience and imagination — they're often powerless against previously unseen attack patterns (zero-day scenarios) and prone to both false positives (blocking legitimate operations) and false negatives (missing malicious ones). The alternative is ML-based anomaly detection, which can theoretically generalize to unknown patterns but requires large labeled datasets and is harder to interpret. Both approaches are being explored in AI agent security today. Aegotrax's choice of heuristics is pragmatic — but it also means its effectiveness depends heavily on the community continuously contributing real attack cases to enrich the rule library.

How to Try It Locally

The project provides a complete local sandbox experience (run in a local sandbox environment only):

git clone https://github.com/aegotrax-dev/aegotrax.git
cd aegotrax
docker compose up --build
# or: pip install ".[demo]" && agentguard-engine
curl http://127.0.0.1:8000/health
python examples/sdk_pilot_example.py

The feedback the author is looking for is specific: Did Docker or pip installation go smoothly? Did you successfully trigger a clear BLOCK decision in the examples? What was confusing or broken? This problem-oriented feedback request signals that the project is in a rapid iteration phase, and early adopters' input will directly shape its direction.

An Observation: The New Frontier of Agent Security

The emergence of projects like Aegotrax reflects a deepening industry awareness around AI agent security. The old defensive focus was on "keeping models from saying bad things." In the agent era, the critical risk is "keeping models from doing bad things." When a model gains the ability to call real tools and affect real systems, the security focus must shift from the language layer down to the action layer.

Combining auditing, intent checking, data provenance, and a policy engine into a pre-execution checkpoint is a logically sound direction. But as the author acknowledges, heuristic policies are no silver bullet — this is more of a beginning than an endpoint. For developers building agent applications, this open-source project at minimum offers a reference architecture worth studying. Even if you don't use it directly, the design principle of "intercept tool calls + audit log" has real takeaway value.

A reminder: this project self-identifies as a pilot prototype, not a production-ready product. Do not rely on it directly in critical business environments.

Background: Prompt Injection

Prompt injection is an attack in which adversaries embed malicious instructions into external content that a model will read — such as web pages, documents, email bodies, or database fields — hijacking the agent's behavior. Similar to traditional SQL injection, it exploits the blurry boundary between "data" and "instructions." For AI agents, this threat is especially severe: agents are often authorized to read large volumes of external data as context, and the model itself has difficulty distinguishing between "content to process" and "commands to execute."

Typical attack scenarios include: appending hidden instructions in white text at the bottom of a PDF résumé to trick a recruiting assistant agent into leaking other candidates' information; or embedding invisible text on a webpage to instruct a browsing agent to send user data to a third-party address. OWASP has ranked prompt injection as the top security risk for LLM applications (No. 1 on the LLM Top 10 list).