Main

Add safety guardrails like you add observability:

• Run Guard on every user message and on every tool-call instruction.
• Redact before logging or storing transcripts.
• Use Scan as part of CI for repos that agents can read, to catch repo poisoning patterns.

Start with "report-only" mode (log findings), then switch to blocking once you see false-positive rates in your domain.

README excerpt (verbatim)

Superagent SDK

Make your AI apps safe.

Website · Docs · Discord · HuggingFace

An open-source SDK for AI agent safety. Block prompt injections, redact PII and secrets, scan repositories for threats, and run red team scenarios against your agent.

Features

Guard

Detect and block prompt injections, malicious instructions, and unsafe tool calls at runtime.

TypeScript:

import { createClient } from "safety-agent";

const client = createClient();

const result = await client.guard({
  input: userMessage
});

if (result.classification === "block") {
  console.log("Blocked:", result.violation_types);
}

Python:

from safety_agent import create_client

client = create_client()

result = await client.guard(input=user_message)

if result.classification == "block":
    print("Blocked:", result.violation_types)

Redact

Remove PII, PHI, and secrets from text automatically.

TypeScript:

const result = await client.redact({
  input: "My email is john@example.com and SSN is 123-45-6789",
  model: "openai/gpt-4o-mini"
});

console.log(result.redacted);
// "My email is <EMAIL_REDACTED> and SSN is <SSN_REDACTED>"

Python:

result = await client.redact(
    input="My email is john@example.com and SSN is 123-45-6789",
    model="openai/gpt-4o-mini"
)

print(result.redacted)
# "My email is <EMAIL_REDACTED> and SSN is <SSN_REDACTED>"

Scan

Analyze repositories for AI agent-targeted attacks such as repo poisoning and malicious instructions.

TypeScript:

const result = await client.scan({
  repo: "https://github.com/user/repo"
});

console.log(result.result);  // Security report
console.log(`Cost: $${result.usage.cost.toFixed(4)}`);

Python:

result = await client.scan(repo="https://github.com/user/repo")

print(result.result)  # Security report
print(f"Cost: ${result.usage.cost:.4f}")

FAQ

Q: Is Superagent open source? A: Yes—repo is MIT-licensed per GitHub license metadata.

Q: How do I install it? A: README shows npm install safety-agent (and uv add safety-agent for Python).

Q: What does it do? A: Guard against prompt injection, redact secrets/PII, and scan repos for threats (per README).