AI Defense Stack

Agent & MCP security

Microsoft Agent Governance Toolkit: open-source agent governance and policy toolkit

Agent Governance Toolkit is an open-source agent governance and policy toolkit from Microsoft. It is released under the MIT license and is offered as: Library, Self-hosted.

  • Last reviewed
Visit Agent Governance Toolkit (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceMIT Layer 7: Agent and tool access

Best for

Engineering teams building agents in Python, TypeScript, .NET, Rust or Go that want policy checks, identity and a kill switch inside the application

Consider instead if

  • You need screening of prompts and tool output for injection, which this toolkit does not do. See Lakera Guard.
  • You want one gateway in front of MCP servers and A2A agents instead of in-app governance. See ContextForge.

What Agent Governance Toolkit does

Agent Governance Toolkit is an open-source (MIT) project that Microsoft announced on its Open Source blog in April 2026. It adds runtime governance to autonomous agents through several packages: a stateless policy engine that checks each agent action before it runs, cryptographic agent identity with trust scoring, execution rings with a kill switch, and reliability tooling with SLO monitoring. SDKs exist for Python, TypeScript, .NET, Rust and Go, with integrations for several agent frameworks. The GitHub page labels releases a public preview that may change before general availability. Microsoft's limitations page says the toolkit governs actions, not model reasoning, so it does not detect indirect prompt injection.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Microsoft Source, checked October 21, 2026: opensource.microsoft.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: MIT Source, checked October 21, 2026: opensource.microsoft.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: opensource.microsoft.com (opens in a new tab)
GitHub stars
6,454 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
June 9, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
Library, Self-hosted Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: opensource.microsoft.com (opens in a new tab)
Website
microsoft.github.io Source, checked October 21, 2026: microsoft.github.io (opens in a new tab)
Documentation
microsoft.github.io Source, checked October 21, 2026: microsoft.github.io (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Coordinated vulnerability disclosure with a 90-day timeline Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Agent Governance Toolkit fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Agent Governance Toolkit covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L2 Discovery Discovery and posture Also covers Documents Shadow AI Discovery, which finds unregistered agents across processes, configs and repos. Shadow AI Discovery finds unregistered agents across processes, configs and repos
L8 Monitoring Monitoring and response Also covers Documents tamper-evident records of every policy decision for agent actions. Produces tamper-evident audit evidence for agent actions

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Agent Governance Toolkit, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM06 Excessive Agency The policy engine checks each agent action before it runs, which limits what an agent can do. Stateless policy engine that checks every agent action before it runs, with policies in YAML, OPA Rego and Cedar

Not mapped in our analysis: LLM01, LLM02, LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Agent Governance Toolkit FAQ

Is Agent Governance Toolkit open source?

Yes. Microsoft's launch post says it is open source under the MIT license, and the code is on GitHub at microsoft/agent-governance-toolkit.

Does it detect prompt injection?

No. The limitations page says the toolkit governs actions such as tool calls, not what an agent thinks or says, and it does not detect indirect prompt injection. Microsoft recommends pairing it with a model-level safety tool.

Is it production ready?

The README describes production-quality public preview releases that may have breaking changes before general availability, and the docs home carries a Public Preview label.

Key facts you can cite

We have no commercial relationship with Microsoft.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.