AI Defense Stack

Agent & MCP security

Invariant Guardrails: rule-based guardrail layer for agents and MCP

Invariant Guardrails is a rule-based guardrail layer for agents and MCP from Snyk. It is open source under the Apache-2.0 license and is offered as: Library.

  • Last reviewed
Visit Invariant Guardrails (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 7: Agent and tool access

Best for

Teams that want to write their own rules over agent tool calls and run them locally or through a gateway they host

Ownership

Snyk announced on June 24, 2025 that it has acquired Invariant Labs, the company behind Invariant Guardrails. Source, checked October 21, 2026: labs.snyk.io (opens in a new tab)

Consider instead if

  • You want a scanner that reviews installed MCP servers and agent skills instead of rules that run on live traffic. See MCP-Scan.

What Invariant Guardrails does

Invariant Guardrails is an open-source rule layer for agent systems built on LLMs or MCP servers. You write rules in a Python-inspired matching language, for example to block an external email after an inbox was read or to flag prompt injection in tool output. Rules can run in the Invariant Gateway, which evaluates each LLM and MCP request before and after it passes, or locally through the invariant-ai Python package. The code is Apache-2.0 on GitHub. Invariant Labs now belongs to Snyk, and the hosted Explorer service was shut down in January 2026. The latest repository push is from January 2026, and the PyPI release is from July 2025.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Snyk (Invariant Labs) Source, checked October 21, 2026: labs.snyk.io (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Ownership
Snyk announced on June 24, 2025 that it has acquired Invariant Labs, the company behind Invariant Guardrails. Source, checked October 21, 2026: labs.snyk.io (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
472 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
January 12, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
July 28, 2025 Source, checked October 21, 2026: pypi.org (opens in a new tab)
Deployment
Library Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
invariantlabs.ai Source, checked October 21, 2026: invariantlabs.ai (opens in a new tab)
Documentation
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Invariant Guardrails fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Invariant Guardrails covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L6 Runtime Runtime guardrails Also covers Documents rules that flag prompt injection in tool output. Example rules flag prompt injection in tool output
L8 Monitoring Monitoring and response Also covers Documents monitoring and steering of agent behavior without invasive code changes. Lets teams monitor and steer agent behavior without invasive code changes

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Invariant Guardrails, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Example rules flag prompt injection in tool output. Example rules flag prompt injection in tool output
LLM06 Excessive Agency Rules can block tool calls and tool-call sequences that an agent should not make. Rule language with typed variables and Python-style conditions that match messages and chains of tool calls; Intercepts tool calls and applies rules to them, such as blocking an external email after an inbox is read

Not mapped in our analysis: LLM02, LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Invariant Guardrails FAQ

Is Invariant Guardrails open source?

Yes. The code is released under the Apache-2.0 license in the invariantlabs-ai/invariant repository on GitHub.

Who owns Invariant Labs?

Snyk announced on June 24, 2025 that it acquired Invariant Labs. The Explorer README says the hosted Explorer service was shut down in January 2026.

How are rules enforced?

Through the Invariant Gateway, which evaluates rules on each LLM and MCP request, or locally through the invariant-ai Python package.

Key facts you can cite

We have no commercial relationship with Snyk (Invariant Labs).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.