A firewall for what AI agents do.
Vanzik checks every tool call an agent makes against your policy before it runs, then records the decision. It was called AgentGuard until version 2.0. It is open source under Apache 2.0 and runs on your own infrastructure.
A prompt is not a control.
An agent with tools can delete a table or send an email in the same loop that decides to do it. A rule written into a prompt lives in the channel an attacker can write to, so it can be argued with.
The first versions of this project were an SDK the agent had to call, which only protects agents that cooperate. Since v0.5, Vanzik also sits on the wire. As an MCP gateway or in front of the OpenAI and Anthropic APIs, it checks each tool call without any change to the agent’s code. The full argument is in the thesis.
What it does, and what it doesn't.
Vanzik does
- Allows, denies or holds each tool call for human approval, from a YAML policy across seven scopes.
- On the wire, refuses a tool call it cannot read instead of forwarding it unexamined.
- Writes an append-only audit trail that can be sealed and verified offline.
- Runs on your infrastructure and makes no outbound calls by default.
Vanzik doesn't
- Sandbox the agent. It does not intercept syscalls, so pair it with containers, seccomp and egress rules against an agent that controls its own runtime.
- Understand what a command means. Rules match strings, so policy quality still decides the outcome.
- See your prompts or tool data, unless you opt in to Vanzik Cloud or configure notifications.
How it got here.
- v0.1First public release, Apache 2.0.
- v0.5MCP gateway and LLM API proxy. Enforcement moves from an opt-in SDK to the protocol boundary.
- v1.0First stable release, multi-node on PostgreSQL.
- v1.1Fail-closed gating and a published threat model.
- v1.3Hooks for Claude Code.
- v1.4Hooks for Cursor, Gemini CLI and Codex CLI, and an audit log sealed with a hash chain.
- v2.0AgentGuard becomes Vanzik. Upgrading moves an existing install across.
Check the claims yourself.
- 0.53 msp99 for a policy decision on the full HTTP check path. CI fails a release that crosses 3 ms.Read the SLOs
- Sealed auditEach entry chains to the last, and vanzik audit verify finds any edit, deletion or reordering offline.Read the audit docs
- Threat modelWho Vanzik defends against, what it trusts, where it fails open or closed, and its non-goals.Read the threat model
- Apache 2.0The full runtime is public. Cloud is a separate layer that never gates it.Read the source
Built in the open.
Vanzik is designed and maintained by Cauã Ferraz, a systems architect and backend engineer in Brazil. He has spent about ten years building backends for e-commerce, fintech and marketing automation, self-taught, and studies Computer Engineering at Inatel.
The source, threat model and release history are public, so you can judge the work directly. The core is Apache 2.0, so you can read it, fork it and run it on your own terms.