AgentGate: Deterministic Guardrails Against Multi-Agent Collusion Carriers

Post-sprint: the v14 tree

The rows above, the sample artifacts [S1]–[S3], and sprint_submission/ are the frozen 25 October Apart Research sprint snapshot at cefec0d. They are not re-run or changed. Later work added four v11 guards (a separate Group D, never added to 57/57), the v11.1 to v12.1 guards, and the fourteen v12.2 to v14 reference validators. That v14 tree is on main via PR #36. The table below keeps the 31 October record of that tree. Re-measured 1 November 2026 on Python 3.12.3 with no php: main at 2dbca57 is 1,159 passed and 6 skipped (1,165 collected), and this branch (PR #34 on top of that) is 1,172 passed and 6 skipped (1,178 collected).

51 modules sit behind pep.py in agent-gateway in the v14 tree (22 at the sprint snapshot, 26 after v11, 29 with v11.1 and the PHP Defense Guard, 33 after v12, 36 after v12.1, 41 after v12.2), including the fourteen reference validators R, W, F, I, P, T, S, V, D, Z, C, E, B and A and their shared common.py (described with measured p99s on the main page; traces 09 and 10 below replay D and Z), the three v12.1 guards (19 further tests cover their PEP, MCP-proxy, hook, SARIF, benign-benchmark, and latency checks), the four v12 evasion guards (27 further tests cover their PEP, MCP-proxy, Claude Code hook, SARIF, and latency checks), the four v11 guards (post-sprint, Group D; 31 further tests cover their PEP, MCP-proxy, and SARIF wiring), the v11.1 Claude Code hook and MCP delivery blueprint, the PHP Defense Guard (Laravel / WordPress / plain PHP runtime input checks), the guards above, the MCP proxy, the toxic-flow analyzer, the SARIF exporter, and the CLI.

Carrier A (post-taint side channel) is covered by the eight tests in test_side_channel_guard.py, including a Hypothesis state machine; it has no browser trace here.

git clone https://github.com/freeling10-prog/rogue-ai-detection
cd rogue-ai-detection/agent-gateway
python -m pip install -e '.[test]'
export AGENT_GATEWAY_HMAC_KEY="$(python -c 'import secrets; print(secrets.token_hex(32))')"
python -m agent_gateway evaluate-collusion --report ./audit_out

To re-record the §3 traces: python ../examples/record_site_traces.py from the same directory with the same key exported.

Claude Code PreToolUse hook, one command

python -m agent_gateway.claude_code_hook --install

Adds one PreToolUse command hook to ~/.claude/settings.json (running it again adds nothing). Before each tool call it denies credential paths (.env but not .env.example, ~/.ssh, ~/.aws, .npmrc, .pypirc), recursive home or root deletion, force pushes to main, download-to-shell pipes, and link-local metadata or file:// targets, and appends a SHA-256 hash-chained entry to ~/.claude/agentgate_audit.jsonl. --self-test runs four validation checks and prints CPU time per decision. Lexical configuration checks, not a sandbox.

Same-author lab checks

The carrier scenarios and the benign workflows were written by the person who wrote the guards. 57/57 shows the guards behave as their tests specify; it is not recall against an unknown adversary. 0/750 is a smoke check, not a false-positive rate for a deployment.

2 of 13 stays separate

The only real-model figure is a loopback archive: qwen2.5:3b against the localhost honeypot, 2 of 13 non-control runs, one machine. It is a different measurement and is never pooled with the lab checks. Not a benchmark.

Loopback only

Default bind is 127.0.0.1. A non-loopback bind needs an explicit flag and an isolated lab network. No public honeypot is deployed; honeypot output is leads for a person.

15-minute lab key freeze

Freeze applies only to keys in the lab registry, for 900 seconds. An unregistered key is never frozen.

Approximate ATLAS

MITRE ATLAS ids are the project’s approximate mappings. Not a certification, and not a statement that anything passes ATLAS, OWASP, NIST, SOC 2, or ISO.

Routed calls only

Calls that bypass the gateway are not seen. An untrusted source that is never labeled never taints a session. Answer-only injections that trigger no gated call are out of scope.

Not a sandbox

No OS sandboxing or network isolation. Anyone holding AGENT_GATEWAY_HMAC_KEY can mint capabilities; key rotation is not implemented. Tool backends in the lab are simulated echoes.

v12.1 guard limits

Inline interpreter writes (python -c, node -e, ruby -e, perl -e, php -r, heredocs, decoded pipes) and MCP tools over-privileged from their first listing are now enforced by interpreter_exec_guard.py and mcp_capability_manifest_guard.py. Both are static: code fetched or decrypted at run time, a path computed from runtime input with no protected literal in sight, or a script file run by name (python x.py) is not analysed, and a tool with a clean schema can still misbehave on its server. An encrypted or paraphrased payload is still not caught. cross_agent_collusion_guard.py sees only routed notes, files, bus messages, and delegations; its labels never decay, so a long-lived shared artifact stays tainted.

v12 guard limits

Lexical and deterministic. mcp_rugpull_guard.py pins what it first sees; the v12.1 capability profile now checks that first listing, but a description can still mislead in plain words. workspace_config_guard.py reads paths and command words; inline interpreter writes are now covered by interpreter_exec_guard.py. control_flow_integrity_guard.py classifies tools by name and argument keys; in the engine a manifest only narrows. stego_exfil_guard.py misses a paraphrased or encrypted secret and one leaked a character per identifier.

v11 guard limits

schema_integrity_guard.py compares digests and normalized names, not what a description means. gui_action_guard.py checks coordinates and key names against configured rectangles and a deny-list; it does not look at the screen. temporal_accumulator_guard.py matches registered tokens and watermark characters within a bounded sliding window per (session, destination); it does not catch a paraphrased value or pieces spread across destinations. memory_provenance_guard.py tracks only resources written through routed tool calls, and its ledger lives in memory unless exported with export_provenance_ledger().

Not a pen test

Not a penetration test, not a red team of anyone’s users, and not legal advice.

Full terms and the out-of-scope list: audit-offer.md. Free alternative: the Apache-2.0 GitHub Action runs the offline analyzer on your own logs.

Sample artifacts

Unedited output of our own collusion-sprint run. Inspect the format before you write.

1. [S1]AgentGate: Deterministic Guardrails Against Multi-Agent Collusion Carriers. Sample executive audit report, PDF, 4 pp., 10.7 kB.
   sha256 5b0e0bbbcde0b124f5a6d9e6fe01e2abde5b37cb0720c97a4faab4376deef146
2. [S2]Collusion sprint briefing deck. Sample briefing deck, PDF, 6 slides, 19.0 kB.
   sha256 94f3564a37f01ceacbf41ff41265252902d0313447005eae2a60a4de3dd515cd
3. [S3]collusion_benchmark_results.json. Sample benchmark artifact, schema agent-gateway.collusion-eval/1, per-test node ids and latency percentiles, 16.8 kB.
   sha256 12759864e7c09d53c85d2b680cd06d35cfb29777102aff0374848def59ead407

Start the clock

Copy the inventory table, fill it in (no secrets, no customer payloads), and send it in the booking thread.