Skip to content
Guard0

g0Background check for AI agents

You wouldn't hire someone without a background check. Why would you deploy an AI agent without one?

$ npx @guard0/g0 check

is anything on this machine known-malicious? · then: npx @guard0/g0 scan .

GitHubDocsnpmStart free →
LangChain
OpenAI
Anthropic
CrewAI
AWS Bedrock
Vercel AI
Salesforce
Rules
1,128
Across 12 security domains, in the g0 repository
Payloads
3,900+
Adversarial corpus shipped with the scanner
Malicious skills
824
Koi audit of ClawHub, Feb 2026, revised upward
Parsers
10
LangChain, CrewAI, MCP and others, plus a generic parser

What g0 does

Every background check answers three questions

You wouldn't hire someone without a background check.

Point g0 at any repo. It discovers every agent, maps every tool, and scores 12 security domains against OWASP, NIST, ISO, and EU AI Act. Every finding tells you what's wrong, where it is, and how to fix it.

$ g0 scan ./my-agent
LangChainLangChain
OpenAIOpenAI
AnthropicAnthropic
CrewAICrewAI
AWS BedrockAWS Bedrock
Vercel AIVercel AI
SalesforceSalesforce
+5 more
g0 scan ./my-banking-agent
g0 v2.4.1 | Framework: langchain (+mcp)
Files: 14 | Agents: 2 | Tools: 4 | Prompts: 2
Goal Integrity60
5 issues
Tool Safety78
4 issues
Identity & Access45
6 issues
Data Leakage82
3 issues
Code Execution52
6 issues
Memory & Context71
3 issues
Supply Chain91
1 issues
Human Oversight88
1 issues
Inter-Agent55
4 issues
Cascading Failures73
2 issues
Reliability Bounds80
2 issues
Rogue Agent66
3 issues
CRITICALShared memory between users
main.py:8 | AA-DL-046 | OWASP:ASI07 | Fix: Isolate memory per user_id
HIGHSystem prompt has no scope boundaries
main.py:21 | AA-GI-001 | Fix: Add role and task boundaries
HIGHDatabase tool without input validation
tools.py:34 | AA-TS-002 | Fix: Add parameterized queries
MEDIUMUnpinned model version
config.yaml:3 | OWASP:ASI04 | Fix: Pin to specific version
Overall:C21 findings | 2 Critical | 5 High | 6 Medium

And that's not all

Everything else the background check covers.

Runtime enforcement

g0 proxy sits on live MCP traffic: deny, redact, coach, or alert on every tool call, with checksum-validated secrets and exact-data-match.

One-command guardrails

g0 protect installs proxy routing, known-malicious quarantine, and Claude Code hook enforcement. Dry-run first, fully undoable.

Red-team any agent

3,900+ adversarial payloads, a 4-level judge cascade, and CVSS scoring against a live agent, HTTP endpoint, or MCP server.

Signed AI-BOM

CycloneDX 1.6 inventory of every model, tool, agent, and MCP server. Content-addressed, so it diffs across releases.

Gate CI and PRs

SARIF, JUnit, and a sticky PR comment via the GitHub Action. Baseline gating fails only on findings new since your baseline.

Runs inside your IDE

g0 mcp serve turns g0 into an MCP server, so Claude Code, Cursor, and Windsurf can scan and vet servers from the chat.

g0 scans your code. Guard0 holds your whole org accountable.

Start with the CLI. Graduate to the platform. Scale to the enterprise.

g0 CLI

Open Source
  • Local-first. No account required.
  • Scan, red-team, and audit MCP servers.
  • Runtime proxy and one-command protect.
  • Gate CI/CD on critical findings.
$ npx @guard0/g0 scan .

Guard0 Cloud

Free Tier
  • Optional g0 login. Never uploads scans.
  • Premium real-time threat feed.
  • Org-wide dashboards for results.
  • Scales with early-stage teams.
Start free

$0 to get started

Guard0 Enterprise

Custom
  • Full agent inventory. Org-wide.
  • Policies. Runtime control. Kill switch.
  • Compliance proof for auditors.
  • On-prem. SIEM. Sentinel fleet rollout via MDM (preview).
Guard0 / accountability systemG0-OSS-00guard0.ai/g0AGPL-3.01,128 rulesRun from your own terminal
Open