Building the "Cloudflare for AI Agents" (Open-Source) 🛡️
Hey hackers,
We are all building AI agents right now. But after talking to enterprise devs and looking at the current landscape, I realized there is one massive blocker preventing production adoption: Fear.
Letting an autonomous LLM decide when to trigger a database query, read an email, or send an API request is terrifying. Existing frameworks (like AutoGen or LangGraph) are amazing for orchestration, but they lack a hard, zero-trust security layer at runtime. Relying on prompt engineering ("please don't do bad things") is not security.
So, I decided to build the missing infrastructure.
Meet Aegisora — an open-source runtime governance and security proxy for AI agents.
Instead of trusting the LLM, Aegisora sits entirely between your agent swarm and the outside world. It intercepts every single tool call and reasoning loop before execution. It evaluates actions against strict policies (PII masking, unauthorized tool blocking, rate limiting) and stops hallucinations or reward hacking in real-time.
The Grand Vision:
We are currently architecting a "Policy & Plugin Hub" where the community can share custom security policies for different LLMs.
Why I'm posting here:
I'm bootstrapping this open-source ecosystem, and I don't just want empty stars. I want brutal, honest feedback from real builders.
- Does this proxy architecture make sense for your current AI stack?
- What is your biggest security nightmare when deploying AI agents?
You can check out the code and architecture here: https://github.com/aegisora-ai/aegisora.ai
If you resonate with the vision, a ⭐️ would mean the world to us and helps bring more visibility to the project. We also have heavily curated good first issues if you want to jump into the codebase!
Let's discuss in the comments.
The strongest part is the hard security boundary around tool execution. “Don’t trust the LLM” is a much more defensible foundation than trying to solve agent safety through prompting alone.
Spot on. That’s exactly the core philosophy driving Aegisora. LLMs are inherently probabilistic—trying to guarantee deterministic safety with natural language (prompts) is a losing battle. A prompt is just a suggestion, but a proxy is a hard rule.
Curious, what kind of tool executions or agent actions are you most paranoid about in your own stacks? (e.g., direct DB queries, external API calls with broad scopes?)
That distinction is what makes the approach compelling. A hard execution boundary is a fundamentally different proposition from trying to make the model behave safely through instructions alone.
I'll start the roast myself: 🔥
We built the core proxy in Python (FastAPI) rather than Rust or Go. The goal was to keep it highly accessible for the AI/ML community to easily write plugins, but obviously, there is a slight latency trade-off when acting as a middleman.
Would love to hear your thoughts: Is using Python a fatal flaw for a runtime proxy, or the right trade-off to build a fast-growing open-source AI ecosystem?