PanGuard AI

PanGuard AI is a free, MIT-licensed security platform built specifically for the AI agent era. Developed solo by Adam Lin (林冠辛) in Taipei, Taiwan, it addresses a gap that traditional security tools miss: AI agents installing skills and MCP servers with full system access and zero review process. The current release is v1.8.26, installable in a single command with no account or signup required.

What It Is

PanGuard AI is an open-source firewall and skills auditor for AI agents. It operates across three pillars: ATR (Agent Threat Rules), an open, executable detection standard analogous to Sigma for SIEM or YARA for malware; Threat Cloud, a self-hosted collective intelligence network that auto-generates new ATR rules from real-world attacks; and Guard, a 4-agent enforcement pipeline (Detect, Analyze, Respond, Report) that processes OS-level events through 768 ATR detection rules. The core runtime, CLI, MCP server, and all 768 ATR rules are MIT-licensed and free forever.

How the Detection Architecture Works

PanGuard uses a three-layer detection model designed to be deterministic by default and AI-enhanced optionally:

• Layer A — ATR rules engine: 768 regex/AST rules evaluated in under 50ms per event. Auto-blocks on match. Zero cost, works offline.
• Layer B — On-device heuristics: Behavioral fingerprinting that detects drift from a skill's declared capabilities. Also auto-blocks.
• Layer C — Optional LLM second opinion: Bring your own key (Anthropic, OpenAI) or run locally via Ollama. Flags for human review only — never auto-blocks.

The Skill Auditor runs 8 checks before any AI skill is installed, gating supply-chain attacks before they reach the agent. At runtime, Guard monitors every whitelisted skill continuously and responds based on confidence thresholds: at ≥85% confidence, it auto-revokes the skill, blocks tool invocation, and quarantines the session.

ATR Standard and Ecosystem Adoption

ATR (Agent Threat Rules) is an independent, MIT-licensed open standard for AI agent threat detection, crosswalked to 10 frameworks including EU AI Act, NIST AI RMF, ISO/IEC 42001, OWASP Agentic Top 10, MITRE ATLAS, and CISA KEV. The vendor reports that ATR rules have been merged upstream into Cisco AI Defense (314 rules, PR #79 and #99) and Microsoft Agent Governance Toolkit (287 rules, PR #908 and #1277), as well as MISP and the OWASP Agentic Security Resource Hub — described by the project as maintainer-accepted contributions, not vendor endorsements.

The platform currently supports 17 AI agent platforms, including Claude Code, Claude Desktop, Cursor, Codex CLI, Windsurf, Cline, VS Code Copilot, Zed, Gemini CLI, Continue, Roo Code, and several others. It auto-detects all installed platforms on setup.

Benchmarks and Coverage

The project publishes corpus-level benchmark results on its research page:

• SKILL.md corpus (498 real-world samples): 100% recall, 97% precision, 0.2% false-positive rate
• Garak benchmark (650 samples, ATR-core families): ~97–98% recall
• PINT prompt-injection corpus (850 samples): 63.2% recall, 99.7% precision
• HackAPrompt: 69.6% recall vs. 28.6% baseline, 100% precision
• OWASP Agentic Top 10 2026: full 10/10 coverage across 768 rules

The vendor notes that false-positive rates are lane-based: approximately 0.24% in enforce mode and ~9% in hunt mode (the default), and cautions against quoting a single blended number.

Update: v1.8.26

The latest release, v1.8.26 (published 2026-07-19), ships support for 17 AI platforms, 768 ATR rules, full OWASP Agentic Top 10 coverage, and reports 67,799 skills scanned with 1,096 confirmed malicious. The project is written in TypeScript (strict), targets Node.js 20+, and uses a pnpm monorepo with packages for the CLI, guard daemon, MCP proxy, skill auditor, MCP server, migrator, and website. The GitHub repository was created in February 2026 and has been actively pushed as recently as July 2026.

Deployment Model and Privacy

PanGuard runs entirely on-device by default. No telemetry leaves the machine unless the user explicitly opts into Threat Cloud participation. When Threat Cloud is enabled, only anonymized threat signatures are shared — matched rule ID, attack category, MITRE technique, coarse country region, and a truncated IP. Prompts, code, file contents, secrets, and hostnames are never transmitted. Inbound community rules are ed25519 signature-verified and fail-closed. The platform supports Linux, macOS, Windows, Docker, and Kubernetes deployments, and is designed for airgap operation.