CtrlAI

Key Features

• •Built-in Guardrail Rules: 19 pre-configured security rules covering file system access (SSH keys, .env), destructive commands, privacy, messaging, and gateway modifications. Enabled by default with per-rule toggles for immediate out-of-the-box protection.
• •Custom Rule Engine: Define rules in YAML using match fields like tool name, action, agent ID, path globs, argument substring, command regex, and URL regex. First-match-wins logic with default allow, supporting complex AND/OR conditions for precise control.
• •Multi-Agent Support: URL structure includes agent ID, allowing separate rule sets, audit logs, and kill switch per agent. Deploy different security policies for production, work, or intern agents from a single proxy instance.
• •Transparent Proxy Architecture: Requires zero code changes to agent SDKs—only a custom baseUrl configuration. Intercepts LLM responses, inspects tool calls, applies rules, and forwards modified responses. Agent code remains completely unaware of the proxy.
• •Dashboard and Audit Logging: Real-time dashboard at /dashboard provides visibility into proxy activity. All tool calls and actions are logged for compliance, debugging, and post-incident analysis.
• •Rule Testing Without Live Traffic: Use the 'ctrlai rules test' command with sample tool call JSON to validate custom rules before deployment. Enables safe iteration on guardrail policies without risking production agents.
• •Kill Switch: Emergency stop mechanism that halts all proxy traffic instantly. Provides a manual override to stop agent actions in critical situations.

Use Cases

• •Restricting Agent Capabilities by Role: Block an 'intern' agent from executing shell commands or writing files using agent-specific rules, while allowing a 'senior' agent full access. Policy is enforced transparently via the proxy URL path.
• •Preventing Credential Exfiltration: Define rules that block tool calls with arg_contains matching '.env' or '.ssh/id_' across read, write, edit, and exec tools. Any attempt to access sensitive files is stopped before reaching the file system.
• •Network Exfiltration Detection: Use command_regex to match patterns like scp, rsync, or nc combined with sensitive file paths (e.g., /etc/passwd). Blocks data transfer attempts automatically, providing a critical security layer.
• •Testing Guardrail Policies Safely: Before deploying new rules, run 'ctrlai rules test' with a sample tool call JSON to see which rules match and what action is taken. This iterative process ensures policies work as intended without live traffic.
• •Multi-Agent Deployments with Separate Policies: Assign a 'main' agent with full capabilities and a 'work' agent restricted to read-only file operations. Each agent gets its own rule set, audit log, and kill switch for fine-grained security management.
• •Out-of-the-Box Agent Safety: Enable all 19 built-in rules on first launch to protect against common attack vectors like SSH key reads, destructive commands, and privacy violations. Immediate safety without writing a single custom rule.

Who is this for?

Developers building AI agents using SDKs like OpenClaw who need to enforce safety policies without modifying agent code. Security engineers responsible for governing LLM tool usage across multiple agents. DevOps teams deploying autonomous agents into production and requiring granular runtime controls. Organizations managing diverse agent roles (e.g., main, intern, work) that need distinct security perimeters. Open source contributors seeking a flexible, zero-code proxy solution for AI agent guardrails.