Runtime and Endpoint Security
Sandboxes, permission firewalls, secret controls, guardrails, scanners, and host-security tools that constrain AI execution; it excludes security training exercises and model-quality benchmarks.
| Project | What it does | Stars | Language | License | Latest release |
|---|---|---|---|---|---|
| nvidia/nemoclaw | Runs coding agents such as Hermes more safely with OpenShell sandboxing and managed inference. | ★ 22.8K | TypeScript | Apache-2.0 | — |
| archestra-ai/openappa | Provides deterministic guardrails to safely control agent execution. | ★ 1.6K | Rust | MIT | v0.35.1 |
| perplexityai/space | A sandbox platform that runs agent and user code in isolation through pluggable runtimes. | ★ 1.5K | Rust | Apache-2.0 | — |
| pipelab-org/pipelock | An agent firewall that scans HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection. | ★ 937 | Go | Apache-2.0 | v3.7.0 |
| ashishsinha1602/schemagate | Restricts SQL agents to authorized tables using row-level-security-aware pruning, blocking access to disallowed data. | ★ 104 | Python | Apache-2.0 | v1.6.0 |
| submilli/submilli-runtime | An isolated WebAssembly runtime that executes agent-generated TypeScript and enforces semantic permissions on outbound calls. | ★ 28 | Rust | Apache-2.0 | v0.4.1 |