Foo GuardBeta
Menu

Foo Guard Beta

Secure AI agents before they reach production

Foo Guard scans agent configurations, enforces organization policy in GitHub and CI, and helps developers remediate findings — using deterministic security rules, not AI scoring.

Block pull requests and CI builds when agent configurations violate your security policy. Optional AI remediation is advisory and separate from enforcement.

Foo Guard is in beta. Analyze an agent for free with no account required. Pro unlocks CLI, GitHub Action, and API access. Team adds native GitHub Checks and organization policy governance.

CI enforcement

How it works

Scan → policy evaluation → GitHub / CI enforcement → remediation. Deterministic analysis runs on Foo Guard's server. Claude is only involved if you choose optional AI remediation afterward.

  1. Step 1

    Scan configuration

    Analyze JSON or YAML agent configurations from the web app, CLI, GitHub App, or CI pipeline.

  2. Step 2

    Evaluate policy

    Deterministic rules produce findings, scores, and grades. Organization and repository policy (failOn, minGrade) determine pass or fail.

  3. Step 3

    Enforce in GitHub / CI

    Team workspaces publish Foo Guard Security GitHub Checks. Pro and Team CLI users fail pipelines on policy violations with exit code 1.

  4. Step 4

    Review findings

    23+ security rules evaluate identity, credentials, permissions, tools, autonomy, and auditability. Scores and severities never come from an LLM.

  5. Step 5

    Remediate

    Use deterministic remediation guidance or optional AI-assisted fixes — separate from scoring and enforcement.

CI enforcement & GitHub security gate

Foo Guard is a security gate for AI agent configurations. When policy fails, GitHub Checks and CI jobs fail — so merges and deployments can be blocked before insecure configurations reach production.

  1. 1.Developer changes an agent configuration in a pull request or CI job
  2. 2.Foo Guard scans the configuration with deterministic security rules
  3. 3.Organization and repository policy are evaluated (failOn, minGrade, baseline regression)
  4. 4.GitHub Check or CI job reports pass or fail — branch protection can require the check before merge
  5. 5.Developer fixes policy violations and re-runs the scan

GitHub Check: Foo Guard Security

Team workspaces publish pass/fail checks on pull requests and default-branch pushes. Policy violations fail the check; operational errors use a neutral conclusion.

Branch protection compatible

Require the Foo Guard Security check in GitHub branch protection or rulesets to block merges that violate policy.

CLI & GitHub Action

Pro and Team API keys power the CLI and GitHub Action. Exit code 1 fails any CI pipeline when policy is violated — GitLab, Azure Pipelines, Jenkins, and others.

Policy-driven thresholds

Set failOn (critical, high, medium) and optional minGrade in organization policy, repository .fooguard.yml, or CLI flags. The strictest source wins.

Baseline regression

Compare scans against a committed baseline to catch security posture regressions in CI.

Deterministic findings

Scores, grades, severities, and pass/fail outcomes come from Foo Guard's rules engine — not from Claude or any external AI provider.

Example GitHub Check output

Foo Guard Security          ✗ Failed

Grade: D · Score: 62 · Policy: failed
Effective threshold: high (organization policy)
Minimum grade: B (repository policy)

Top findings:
  AG-003  Overly broad tool permissions  (high)
  AG-007  Missing audit logging          (medium)

Require this check in branch protection to block merges.

See GitHub Checks, CI/CD enforcement, and branch protection for setup details.

Trust and product boundaries

FAQ

Can Foo Guard block a pull request or CI build?

Yes. Team workspaces publish Foo Guard Security GitHub Checks that fail when policy is violated. Pro and Team users can also fail CI jobs with the CLI (exit code 1) or GitHub Action. Require the check in branch protection to block merges.

Does Foo Guard prove my agent is secure?

No. Foo Guard identifies likely security risks in configuration and enforces your policy thresholds. It helps you find issues before deployment — it does not certify safety.

Does AI determine my security score?

No. Deterministic rules evaluate your configuration. Optional Claude remediation is advisory and separate from scoring and enforcement.

Do I need an account to try it?

No. Anonymous analysis remains available. Create an account to save history. Pro unlocks CLI, GitHub Action, and API access. Team adds native GitHub Checks and organization policy.

Configuration Editor

Paste or upload JSON or YAML. Foo Guard runs deterministic security checks here — AI is only used if you choose remediation.

Try an example or paste your own agent configuration

Examples are synthetic demos. Your configuration is processed by Foo Guard's analysis server using deterministic rules — not by AI during the scan.

  • Your own config: paste JSON or YAML below, or upload a file.
  • Privacy: anonymous analyses are not saved. Sign in to store sanitized snapshots only.
  • Secret handling: detected secrets are redacted to [REDACTED] before downstream processing.

Paste Configuration

Drag and drop a `.json`, `.yaml`, or `.yml` file, or upload from your machine.