Top 16 Rust ai-security Projects
-
Project mention: Gate: a deterministic PII boundary between your data and AI agents | dev.to | 2026-06-04
If you've been holding off on connecting your AI agent to a real data source — database, internal API, or MCP server — because "what the model sees" was a vibes-based decision, this is the layer that turns it into a config file. Try it, scan your schema, and share what you find. The repo is github.com/GaaraZhu/gate. The issue tracker is open. The license is MIT.
-
AppSignal
AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.
-
agentshield
🛡️ The security firewall for AI agent tools & MCP servers (Claude 5, GPT-5.6, Gemini 3.8, Antigravity, Cursor, Codex, Hermes). Catch command injection, secret theft & toxic flows in <50ms. 100% offline Rust SAST + 1-click auto-fix + SARIF. (by aiconnai)
Project mention: AgentShield – Offline Rust security scanner for AI agent tools and MCP (<50ms) | news.ycombinator.com | 2026-08-16 -
Rullst
📜🦀🌐 Intelligent, Secure and Effortless Super Full-Stack Framework 🌐🦀📜"Rust for those who want to build securely and easily, but not suffer"🤖 The Next-Gen Paradigm: Designed for Humans & AI. Rullst is built from the ground up to be a developer-first framework, optimized for seamless AI-assisted coding and effortless human productivity.
-
quantmlayer
Kernel-enforced containment for AI coding agents - the agent runs with your privileges; the cell enforces what it's allowed to do. Linux, Rust.
Project mention: QuantmLayer – kernel sandbox for coding agents that learns its policy | news.ycombinator.com | 2026-06-13 -
IronWarden
High-performance sovereign AI reverse proxy & streaming ingress engine in Rust (Axum, Tokio) with real-time SSE token rehydration and HMAC audit chaining.
Project mention: IronWarden – A microsecond PII firewall for streaming LLMs in safe Rust | news.ycombinator.com | 2026-09-25 -
Armorer-Guard
Fast local Rust scanner for AI-agent prompt injection, credential leaks, exfiltration, and risky tool calls
Project mention: Agent security needs a local enforcement point, not just logs | dev.to | 2026-06-22Try it in the browser: https://huggingface.co/spaces/armorer-labs/armorer-guard-demo Source: https://github.com/ArmorerLabs/Armorer-Guard
-
vellaveto
Agentic security control plane for MCP and AI agent tool calls. MCP-native policy gateway with topology discovery and audit. (by paolovella)
Project mention: Show HN: VellaVeto – fail-closed gateway for MCP tool calls | news.ycombinator.com | 2026-03-28 -
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
sigil
AI Security Posture Management (AI-SPM) for developer machines: scores AI coding agent guard surfaces (Claude Code, Codex, Gemini CLI, Cursor — hooks, permissions, sandboxes) and ships hash-anchored events to your SIEM. (by Ju571nK)
Project mention: "It's not a bug, it's spec": a zero-click RCE in AI coding agents that three vendors won''t patch | dev.to | 2026-06-02That's the layer I've been poking at. I've been building a small open-source thing (Sigil) that watches agent config files like mcp.json and .claude/settings.json, scores the risk, and emits an event to your SIEM — it doesn't block, it just tells you when the permission state changed while your hands were off the keyboard. Across a fleet of machines that shows up as triage-able alerts — the silent change, made visible:
-
topgent
Monitor your local AI agents. See what files they can reach, what networks they communicate with, and stop them if required. Detect a rogue agent.
How do you spot and stop a rogue AI agent on your machine? https://github.com/farikonsec/topgent
-
Argos-mcp-guardrail
A lightweight, sub-millisecond security shim that prevents AI agents from accessing sensitive files (.env, SSH keys) and executing destructive commands via MCP.
Project mention: Argos –- A 1MB Rust Security Shim for Model Context Protocol Servers | news.ycombinator.com | 2026-10-07 -
customhouse
Deterministic MCP proxy that blocks money-moving and data-egress tool calls in any agent session that has received untrusted content. No model in the decision path.
Project mention: Blocking prompt injection deterministically costs 40% false positives | news.ycombinator.com | 2026-08-17 -
Project mention: The Agent Doesn't Have to Be Malicious for the Action to Be Dangerous | dev.to | 2026-09-08
A dangerous outcome The agent may be doing exactly what it was designed to do. The action itself may even look completely reasonable. But the outcome can still cross a boundary that should have existed. As AI moves from generating text to taking actions, I think we will increasingly need to distinguish between: What an AI agent can do and What an AI agent should be allowed to do Those two things are not the same. What do you think? I'm particularly interested in hearing from people working with: AI agents coding agents developer tools AI security cybersecurity agent frameworks Do you think AI agents need an independent action boundary? Or should security primarily remain inside: the model? the agent framework? the operating system? the tools themselves? I'd love to hear different perspectives. ActionGuard I'm building ActionGuard as an open-source exploration of an independent AI Action Safety Boundary. Give AI room to work. Keep control of what it can do. GitHub: https://github.com/SeanXChen/ActionGuard
-
project-guardian
AI Guardian Firewall — a local, user-space, agent-agnostic firewall that mediates an autonomous AI agent's actions (files, shell, network, services) with a deterministic policy boundary, a tamper-evident audit log, and a human-in-the-loop approval cockpit. No kernel modules. Apache-2.0.
Project mention: A user-space firewall that gates an AI agent's actions | news.ycombinator.com | 2026-06-29 -
Project mention: Comment and Control: a GitHub comment hijacks Claude Code in CI | dev.to | 2026-06-02
Three lines of YAML, one secret. No gateway to deploy. The same call works in the Cursor IDE, on a laptop, or in any pipeline via clampd-guard directly.
-
umai-core-ce
The open-source Kernel Semantic Firewall (KSF) for the AI ecosystem. Powered by eBPF and XDP.
Project mention: UMAI Core CE – An eBPF semantic firewall for AI protocols | news.ycombinator.com | 2026-05-19 -
Project mention: I built a static + runtime security scanner for MCP servers (Rust) | dev.to | 2026-08-18
TL;DR: MCP (Model Context Protocol) has had 40+ CVEs disclosed just this year, and there wasn't a purpose-built scanner for it, so I built one. sentrymcp does static analysis (path traversal, injection, tool poisoning, missing auth) plus a runtime proxy mode that catches "rug pulls" — servers that silently change a tool's description after you've already approved it. Rust, MIT, Docker one-liner. Repo: https://github.com/zaydmulani09/sentrymcp
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
Rust ai-security discussion
Rust ai-security related posts
-
Blocking prompt injection deterministically costs 40% false positives
-
Gate: a deterministic PII boundary between your data and AI agents
-
"It's not a bug, it's spec": a zero-click RCE in AI coding agents that three vendors won''t patch
-
Show HN: Pipelock – All-in-one security harness for AI coding agents
Index
What are some of the best open-source ai-security projects in Rust? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | gate | 36 |
| 2 | agentshield | 20 |
| 3 | Rullst | 18 |
| 4 | quantmlayer | 7 |
| 5 | IronWarden | 8 |
| 6 | Armorer-Guard | 6 |
| 7 | vellaveto | 6 |
| 8 | sigil | 6 |
| 9 | topgent | 4 |
| 10 | Argos-mcp-guardrail | 3 |
| 11 | customhouse | 2 |
| 12 | ActionGuard | 2 |
| 13 | project-guardian | 2 |
| 14 | clampd | 1 |
| 15 | umai-core-ce | 0 |
| 16 | sentrymcp | 0 |
Sponsored