Runtime & evidence
Put a gateway in front of your MCP servers and your model that allows, redacts, tokenizes or blocks each call and its result, watch production runs for drift, and publish what you measured.
Runtime privacy gateway
Every other check reads a trace after the fact. agentleak proxy sits between your agent and an MCP server and judges each tools/call against your flow rules before it is sent. The call is allowed, redacted or blocked, and the decision goes into a hash-chained evidence log.
The proxy launches the real server as a child process and forwards JSON-RPC untouched, except tools/call, which goes to the policy first.
A SIN sent to your KYC vendor for identity checks is fine. The same SIN sent to analytics is a leak. Rules name the data type, the sender, the recipient and the declared purpose.
Each decision is one line carrying the hash of the line before it. agentleak evidence verifies the chain and names the first entry that was edited, removed or reordered.
Guard an MCP server
{
"mcpServers": {
"github": {
"command": "agentleak",
"args": ["proxy", "--config", "agentleak.yaml",
"--evidence", "evidence.jsonl", "--",
"npx", "-y", "@modelcontextprotocol/server-github"]
}
}
}Model gateway
Every prompt is a message to a third party, and a tool result pasted into the next turn carries whatever the tool returned. The same flow rules that guard MCP tools can guard the model: an OpenAI-compatible proxy, or a guardrail inside the LiteLLM proxy you already run.
Point the client's base URL at the proxy. Requests are judged with the provider as recipient; refusals come back as an error the OpenAI client already raises.
Teams that already route through LiteLLM add AgentLeak as a custom guardrail: the request is judged before the call, and tokens are put back after it.
A streamed answer is relayed without judging it — its request is still judged. Non-streamed answers can be judged with --inspect-responses.
Put it in front of your model
pip install agentleak
agentleak llm-proxy --upstream https://api.openai.com --config agentleak.yaml
export OPENAI_BASE_URL=http://127.0.0.1:8788/v1Continuous privacy monitoring
Prompts change, tools are added and models are swapped after release. AgentLeak samples live runs, watches the rolling privacy score and alerts on sustained regression or a severity the deployment has never produced before.
Score a configurable share of runs in process. Five percent gives a useful trend at production volume without turning every response into a security job.
Wait for enough evidence before alerting on ordinary drift, but report a severity the deployment has never seen on its first occurrence.
Monitoring must never become the reason an agent stops serving users. Alert callbacks run outside the lock and their errors are swallowed.
Watch a sampled production run
from agentleak import Monitor, watch
monitor = Monitor(sample=0.05, drop=10, on_alert=notify_team)
if monitor.should_sample():
with watch(project="support-bot") as run:
answer = agent(request)
monitor.record(run.report.to_dict())Verifiable public proof
Turn the latest AgentLeak run into a public trust page and README badge. Visitors see the score, verdict, measurement date, detection tiers and trend—never the findings or sensitive values behind them.
The badge cannot cherry-pick a passing result. It always follows the most recent run and turns grey after 30 days.
A pattern-only pass is narrower than a full pipeline pass. The page names the tiers that ran, and a degraded run can never display the passing colour.
Public proof confirms that a measurement happened and how strong it was. It never exposes the findings, trace contents or sensitive values.
Publish and link the latest result
curl -X POST https://www.agentleak.org/api/projects/<id>/publish \
-H 'content-type: application/json' \
-d '{"slug":"support-bot"}'
[]
(https://www.agentleak.org/a/support-bot)FAQ