AGENT GUARD

Agents changed who can act on a machine.

Developer machines now host tools that can inspect repos, call MCP servers, run commands, and change workspaces at speed. When an agent runs a remote script, edits a release branch, or switches into a more permissive mode, that is software delivery trust moving on a machine.

01

RUNTIME

Fast decisions belong on the hot path.

Agent Guard accepts bounded runtime events, runs deterministic detectors, and returns an allow, warn, or block decision quickly. A remote script execution, destructive filesystem command, package-manager operation, or elevated permission mode should not wait for a model to have an opinion.

  • Remote script and destructive filesystem patterns
  • Policy-backed warn or block decisions
  • Post-response evidence persistence for operator review
02

EVIDENCE

Activity should be searchable without becoming surveillance theater.

Uncain keeps searchable metadata and bounded evidence so teams can understand what happened without flooding the dashboard with raw event exhaust. Operators should be able to answer which machine, which agent, which workspace, and which decision.

  • Machine, session, and agent inventory rollups
  • Tool, MCP server, and workspace context where it affects trust
  • Raw push keys never stored, logged, or written to evidence
03

MODEL

This is not vague AI security.

The concern is concrete: an agent can act with authority. Uncain watches the action, the workspace, the permission mode, and the policy decision that follows.

  • Elevated permission mode detection
  • Destructive filesystem and remote script patterns
  • Package-manager operations recorded as structural evidence

PRINCIPLE

Agent work needs a decision trail.

Open the graph that keeps runtime decisions legible after the command returns.

Open Uncain