Superagent SDK
Secure AI applications against prompt injection, sensitive-data exposure, and repository-borne threats.
- Source repo
- superagent-ai/superagent
- Stars
- ★ 6.8k
- Last updated
- 2mo ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 39/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformClaude Code · OpenAI API · Claude API
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A team operating a public-facing assistant can call Guard on userMessage before passing it to a model or tool, then reject requests classified as "block".
- Not a fit if
- Teams that need fully offline operation without any vendor cloud
- Users who need the red-team Test capability today, since it is coming soon
- Teams wanting to self-host Guard weights without deployment docs or hardware requirements
- Source review
- 39/100 · Major gaps 3 safety controls not found
What does this agent do, and when should you use it?
Superagent SDK is an open-source security SDK for AI applications with Guard, Redact, Scan, and a planned Test capability. The repository documents TypeScript and Python SDKs, a CLI, and an MCP Server for Claude Code and Claude Desktop. Guard evaluates runtime input and returns a classification and violation types so an application can block prompt injections, malicious instructions, or unsafe tool calls. Redact processes text and returns redacted content for PII, PHI, and secrets, while Scan accepts a repository URL and returns a security report with usage cost. It is described as compatible with models from OpenAI, Anthropic, Google, Groq, and Bedrock, and also offers open-weight Guard models for deployment on your own infrastructure.
After creating a client with createClient(), an application calls client.guard({ input }) on a user message. If result.classification is "block", the application can inspect result.violation_types and stop the request. client.redact({ input, model }) processes text and exposes the sanitized result in result.redacted. client.scan({ repo: "https://github.com/user/repo" }) analyzes a specified repository for AI-agent-targeted attacks, including repo poisoning and malicious instructions, then returns a security report in result.result and cost data in result.usage.cost. The README also shows client.test({ endpoint, scenarios }) for red-team scenarios, but labels that feature as coming soon.
- A team operating a public-facing assistant can call Guard on userMessage before passing it to a model or tool, then reject requests classified as "block".
- A product team processing support messages, health-related text, or submitted user content can use Redact to remove PII, PHI, and secrets before further processing.
- A security team evaluating a third-party GitHub repository or external codebase can submit its repository URL to Scan and review the resulting report and reported cost.
- A developer using Claude Code or Claude Desktop can use the documented MCP Server integration option.
- A team that wants to run Guard in its own environment can select the 0.6B, 1.7B, or 4B open-weight model, including the listed GGUF CPU variants.
How do you install or deploy this agent?
Sign up at superagent.sh and obtain an API key. For TypeScript, run: npm install safety-agent. For Python, run: uv add safety-agent. Then set the key in your shell: export SUPERAGENT_API_KEY=your-key.
How do you use this agent?
A minimal TypeScript Guard call is: import { createClient } from "safety-agent"; const client = createClient(); const result = await client.guard({ input: userMessage }); if (result.classification === "block") { console.log(result.violation_types); }. For redaction, call client.redact({ input: "My email is [email protected] and SSN is 123-45-6789", model: "openai/gpt-4o-mini" }) and read result.redacted. In Python, use from safety_agent import create_client, create the client with create_client(), then call await client.guard(input=user_message) or await client.scan(repo="https://github.com/user/repo").
What are this agent's strengths and limitations?
- It documents TypeScript, Python, CLI, and MCP Server delivery options, covering embedded application use, automation, and Claude Code/Claude Desktop integration.
- Guard, Redact, and Scan return program-consumable outputs—classification and violation types, redacted text, and a security report with cost—rather than only general safety guidance.
- The repository lists 0.6B, 1.7B, and 4B open-weight Guard models plus GGUF CPU versions; it states that self-hosting can keep data in the environment.
- Scan is explicitly aimed at repository attacks against AI agents, including repo poisoning and malicious instructions.
- The SDK quick start requires signing up at superagent.sh and configuring a SUPERAGENT_API_KEY.
- The README does not document API pricing, quotas, authentication-failure behavior, or complete response and error schemas for Guard, Redact, and Scan.
- The Test red-team interface is labeled coming soon, so it should not be treated as a currently available capability.
- Although self-hosted Guard weights are listed, the README does not provide deployment commands, hardware requirements, or inference-service configuration.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Superagent SDK This agent | 39 · Major gaps | Library / SDKFreemium | ★ 6.8k | 2mo ago | TypeScript | Claude Code · OpenAI API · Claude API |
| Stakpak | 57 · Major gaps | CLIFree + model costs | ★ 1.9k | 4mo ago | Rust | OpenAI API · Claude API |
| T3MP3ST Security Harness | 55 · Major gaps | CLIFree + model costs | ★ 6.9k | 1mo ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
| HOL Guard | 79 · Good | CLIFreemium | ★ 1.1k | today | Rust | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: SDK requires API key but least privilege not explicit; no user confirmation mechanism; data flow transparency limited, only mentions data not leaving environment; sensitive data handling has redact feature but storage/transmission not specified; dependency security not mentioned; external effects include API calls and network requests but side effects not described; no rollback mechanism; source attribution has MIT license and copyright but publisher unverified. Deductions: missing least privilege, user confirmation, rollback, and other key security mechanisms.
Evidence shows: README and tests are consistent, but tests are mocked and do not verify real behavior; dependency availability not stated; failure messages not provided. Deductions: tests do not cover real API calls, dependency and error handling info insufficient.
Evidence shows: targets developers, offers multiple integration options (SDK, CLI, MCP), scenarios clear; capability boundaries not clearly defined; trigger precision not detailed; environment fit has TypeScript and Python versions but not all environments. Deductions: capability boundaries and trigger conditions insufficiently described.
Evidence shows: information architecture clear, README and docs links; install instructions clear; naming stable (safety-agent); examples and FAQ links present; known limitations not explicit; license MIT; versioning and changelog missing; maintenance responsibility not clear. Deductions: missing versioning and changelog, known limitations not stated.
Evidence shows: output usability high, clear result structures; marginal value high, provides security features; cost-benefit not detailed but cost mentioned. Deductions: cost-benefit analysis insufficient.
Evidence shows: claims supported by docs and models but no concrete evidence; cross-source verification limited; facts and inferences not clearly separated. Deductions: lack of verifiable test results and independent verification.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Publisher unverified, identity unknown.
- Tests are mocked, real API behavior not verified.
- Missing versioning and changelog, maintenance responsibility unclear.
- Dependency security not mentioned, need to check dependency vulnerabilities.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Node.js Package Release Installation Options Via npm: ```bash npm install -g ai-firewall ``` Via GitHub Packages: ```bash npm install -g @superagent-ai/ai-firewall ``` Via Docker: ```bash docker pull ghcr.io/superagent-ai/superagent/node:0.0.9 ``` Via binary download: Download the appropriate binary for your platform and extract it. Usage ```bash ai-firewall start --port 8080 --config superagent.yaml ``` What's Changed See the auto-generated release notes below.View on GitHub ↗ -
Release notes excerpt
Rust Package Release Installation Options Via crates.io: ```bash cargo install ai-firewall ``` Via Docker: ```bash docker pull ghcr.io/superagent-ai/superagent/rust: ``` Via binary download: Download the appropriate binary for your platform below. What's Changed See the auto-generated release notes below.View on GitHub ↗ -
Release notes excerpt
Rust Package Release Installation Options Via crates.io: ```bash cargo install ai-firewall ``` Via Docker: ```bash docker pull ghcr.io/superagent-ai/superagent/rust: ``` Via binary download: Download the appropriate binary for your platform below. What's Changed See the auto-generated release notes below.View on GitHub ↗