Sasy Guard

Agentic security through compiled policies that reason over an agent's actions and their provenance. Authorization and safety rules become deterministic policies, enforced outside the agent, that decide from what the agent actually did and where each action's data came from across the session, not from the model's own judgment.

Install the setup skill, then start your coding agent and ask it to set up Sasy Guard:

npx skills add -g sasy-labs/sasy-guard

The agent checks the requirements, installs the runtime, adds the guard to itself, and tells you how to test it. Each agent’s page below has the steps by hand.

Supported Agents

Sasy Guard checks each action a coding agent is about to take, such as running a command or editing a file, before the action runs. It works with these agents:

Claude CodeA plugin you can set up in minutes, or a mod for deeper integration.

piAn extension that checks every tool call pi makes.

Codex CLIA hook that checks every tool call Codex makes.

All three use the same policy engine and the same policy. Each agent connects to the engine through a small adapter: a piece that translates the agent’s tool names and its saved conversation history into one shared format the engine reads. Supporting another agent means writing one more adapter, not changing the engine or the policy.