Open source. Self-hostable. Apache 2.0.
Stop Trusting. Start Verifying.
Agent Guard is middleware that verifies every A2A agent request: identity, integrity, freshness.
No more "trust me, I'm billing-agent." Prove it. Ed25519 signatures, SHA-256 body hashing, 60s freshness window. Sub-millisecond verification.
pip install capiscio-sdkAgent Identity (Who)
Ed25519 signature verification. Not user login: agent-to-agent caller authenticity.
Blocked when: attacker impersonates billing-agent
Request Integrity (What)
SHA-256 body hash bound to signature. Any modification fails.
Blocked when: proxy modifies transfer amount
Freshness (When)
Strict iat/exp validation. 60s window, 5s skew tolerance.
Blocked when: stale request replayed after window expires
How Agent Guard Verifies Every Request
Step-by-step verification flow and failure modes
Verification Flow
X-Capiscio-Badge header (compact JWS)kid claim in trust storeiat/exp within 60s windowbh claimFailure Modes (Fail-Closed)
X-Capiscio-Badge → 401 Unauthorized403 Forbiddenkid not in trust store → 403 Forbidden403 Forbiddeniat in future beyond 5s tolerance → 403 Forbiddenbh → 403 ForbiddenDetailed failure reasons are logged server-side for debugging and SIEM integration.
Verification Defaults
These are the default verification parameters. SDK constructors accept dev_mode and base_dir options.
Real-World Threats Blocked
How agent security failures actually happen, and how Agent Guard stops them
Spoofed Agent Call
Scenario: Attacker claims to be 'billing-agent' to trigger unauthorized refund.
Signature check fails. Only the holder of billing-agent's private key can produce a valid signature.
Tool Router Tampering
Scenario: Prompt injection causes tool call parameters to drift. Transfer amount changed in transit.
Body hash mismatch. The signature covers SHA-256(body). Any change invalidates it.
Stale Request Replay
Scenario: Valid request captured by attacker, replayed after freshness window expires.
60s window. Requests older than the window are rejected. For idempotency within the window, use jti claims.
Drop-in Protection in Two Lines
Simple integration for any stack
pip install capiscio-sdkv2.3.1from fastapi import FastAPI
from capiscio_sdk.simple_guard import SimpleGuard
from capiscio_sdk.integrations.fastapi import CapiscioMiddleware
app = FastAPI()
# Zero config: auto-discovers agent-card.json and key material
guard = SimpleGuard(dev_mode=True)
app.add_middleware(CapiscioMiddleware, guard=guard)
@app.post("/agent/message")
async def handle_message():
# Only reached if agent identity, integrity, and freshness checks pass
return {"status": "verified"}Need explicit keys, trust stores, or environment-based secrets? Check the advanced configuration docs.
Minimal Latency Overhead
Optimized for high-throughput agent traffic. Built for production workloads.
Fail-Closed Design
Invalid signatures, expired timestamps, or tampered payloads are rejected immediately.
The SimpleGuard Standard
Cryptographic enforcement details for security engineers
Ed25519 (Edwards-curve Digital Signature Algorithm).
Trust Badge in X-Capiscio-Badge header. Proves which agent signed.
SHA-256 body hash.
Bound to the JWS as bh claim to prevent tampering.
Strict iat and exp checks.
Default 60s window with 5s clock skew tolerance.
Immediate rejection.
Returns 401 Unauthorized or 403 Forbidden on any failure.
What Agent Guard Doesn't Do
Honest boundaries. No false promises.
Not a prompt filter
Agent Guard doesn't inspect or sanitize prompt content. It verifies the caller, not the message semantics.
Not rate limiting
Agent Guard doesn't throttle requests. Pair with your existing API gateway or rate limiter.
Not authorization
Agent Guard proves who is calling, not what they're allowed to do. Authorization is your business logic.
Not content moderation
Agent Guard doesn't block toxic content or policy violations. Use appropriate content filters upstream.
Agent Guard does one thing well: cryptographic identity verification with tamper detection and replay protection for A2A protocol traffic.
"Why not just use API keys?"
The question every developer asks. Here's the honest answer.
| Capability | API Keys | mTLS | Agent Guard |
|---|---|---|---|
| Proves caller identity | Shared secret | ✓ Certificate | ✓ Ed25519 signature |
| Detects payload tampering | ✗ | Transport only | ✓ SHA-256 body hash |
| Prevents replay attacks | ✗ | ✗ | ✓ 60s window |
| Works through proxies/gateways | ✓ | ✗ TLS terminates | ✓ Application-layer |
| Survives key leak | ✗ Full compromise | Revocation lag | ✓ Per-request signing |
| Audit trail per request | Key ID only | Cert CN only | ✓ Full agent identity |
API Keys are fine when...
You control both ends, trust the network, and don't need per-request attestation.
mTLS is fine when...
You have PKI infrastructure and don't route through load balancers that terminate TLS.
Agent Guard when you need...
Per-request identity proof, tamper detection, and replay protection for A2A agent-to-agent traffic, especially across trust boundaries.
Bottom line: API keys prove you have a secret. Agent Guard proves which agent signed this specific request at this specific time.
Flexible Deployment
Choose the integration that fits your architecture
- Zero infrastructure dependency
- Native framework support (FastAPI, Flask, Django)
- Ideal for monolithic agent services
- Protect any service (Node, Rust, Ruby)
- Deploy as Kubernetes sidecar
- Offload crypto operations
How CapiscIO Agent Guard fits with your existing stack
We don't issue identities; we verify them at every agent call—internal or external.
- Works with your IAM (Okta, AWS IAM). Doesn't replace it. Guard handles agent-to-agent identity, not user identity.
- Sits next to your API gateway, enforcing per-message agent identity and payload integrity. Not a replacement for Kong or Envoy.
- Focused on agent-to-agent and agent-to-tool calls, not generic network traffic or user sessions.
payment-agent on Vercel calling ledger-agent on AWS. Guard ensures the request is signed, untampered, and fresh regardless of where each agent runs.The CapiscIO Stack
Catch issues before you deploy
Agent Guard protects you at runtime, but the CapiscIO CLI helps you validate agent cards and test endpoints during development and CI/CD.
- Validate locally - Check A2A agent cards and signatures before commit
- CI/CD Gates - Use the
capiscioCLI and GitHub Action to block invalid or non-responsive agents before deployment
Ready to Secure Your A2A Agents?
Start with the open source Agent Guard and CLI today. Need MCP server protection? Check out MCP Guard.
Frequently Asked Questions
Everything you need to know