# Vanzik

> Vanzik (formerly AgentGuard) is the open-source policy firewall for AI agents: a wire-level runtime firewall written in Go. It intercepts at the protocol boundary, through an MCP gateway and an LLM API proxy, evaluates a YAML policy on every tool call, and writes an append-only audit trail. Built and maintained by Lictorate. Policy precedes action.

- [Site](https://vanzik.lictorate.com)
- [Source](https://github.com/lictorate/vanzik)
- License: Apache 2.0
- Latest release: v2.0.0 (2026-10-26): AgentGuard renamed to Vanzik; server, MCP gateway, LLM API proxy, and both SDKs all at 2.0.0 ([release notes](https://github.com/lictorate/vanzik/releases/tag/v2.0.0))
- Stage: v2.0. AgentGuard is now Vanzik, and `vanzik migrate --from-agentguard` moves a 1.x install over; hooks for Claude Code, Cursor, Gemini CLI and Codex CLI; tamper-evident sealed audit log with `vanzik audit verify`; policy tests with `vanzik test`; session replay; compliance reports; one-command install and `vanzik setup`; multi-node, fail-closed wire gating, chained shell commands checked one by one, secrets masked in the audit trail, additive-only frozen surface · Vanzik Cloud in design, waitlist open
- Maintainer: Cauã Ferraz, Lictorate (hello@lictorate.com) · Security reports: security@lictorate.com

## What it is

Vanzik is the wire-level checkpoint between an agent and everything it touches. The agent issues a tool call; Vanzik evaluates a YAML policy (`version: "1"`, seven scopes: shell, filesystem, network, browser, cost, data, mcp_tool); the call proceeds, pauses for human approval, or is denied. Rule precedence: deny → require_approval → allow → default deny. Every decision is written to an append-only JSON-Lines audit trail, which since 1.4.0 can be sealed into a verifiable hash chain.

## Install

One command installs the server (`vanzik`), the MCP gateway (`vanzik-mcp-gateway`) and the LLM API proxy (`vanzik-llm-proxy`) after verifying them against the release's `checksums.txt`, and writes a starter policy. Running it again updates, and on a computer with AgentGuard 1.x it moves that install over (see "Upgrading from AgentGuard 1.x" below). The installers and the container image were tested against the published v2.0.0 release on Linux (amd64, arm64), Alpine, macOS (Apple silicon, Intel) and Windows (PowerShell 5.1 and 7).

- macOS / Linux: `curl -fsSL https://github.com/lictorate/vanzik/releases/latest/download/install.sh | sh`
- Windows (PowerShell): `irm https://github.com/lictorate/vanzik/releases/latest/download/install.ps1 | iex`
- Docker (multi-arch; bash/zsh): `export VANZIK_API_KEY="${VANZIK_API_KEY:-$(openssl rand -hex 32)}"` then `docker run -d -p 8080:8080 -e VANZIK_API_KEY="$VANZIK_API_KEY" -v vanzik-audit:/var/lib/vanzik ghcr.io/lictorate/vanzik:latest`. The server needs an API key to accept connections from outside the container; without one it listens on localhost inside the container only. Keep the key: the dashboard and API use it.
- Go 1.26+: `go install lictorate.com/vanzik/v2/cmd/vanzik@latest`
- SDKs: `pip install vanzik` · `npm install @lictorate/vanzik`

Then: `vanzik setup`, a menu that starts Vanzik at login with the starter policy and an API key, opens the dashboard, and later updates or uninstalls it. Or run the server yourself: `vanzik server --dashboard`. To uninstall without the menu: `curl -fsSL https://github.com/lictorate/vanzik/releases/latest/download/install.sh | sh -s -- --uninstall` (Windows: `$env:VANZIK_UNINSTALL=1; irm https://github.com/lictorate/vanzik/releases/latest/download/install.ps1 | iex`); the policy is kept unless you add `--purge`. Setup guide: https://vanzik.lictorate.com/docs/setup

## Upgrading from AgentGuard 1.x

Before 2.0 Vanzik was called AgentGuard. 2.0.0 renames everything (programs, `VANZIK_*` environment variables, folders, the image, the Go module `lictorate.com/vanzik/v2`, the SDK packages), and the rename is its only breaking change: the policy schema, the `/v1/*` wire protocol, the audit log format and seal, the store and every existing flag are as in 1.4.0, so policies, audit logs and databases carry over unchanged.

- Run the 2.0 install command above as the user who set AgentGuard up. The installers, and `vanzik setup`, run `vanzik migrate --from-agentguard`: it moves the login service, the config and data folders and the database, and points the Claude Code, Cursor, Gemini CLI and Codex hooks at `vanzik`, keeping a backup of every file it edits.
- An `AGENTGUARD_*` variable that would be used now stops the program instead of being ignored; rename it to `VANZIK_*`.
- 1.x's in-place update (`agentguard setup` → Update) can't install 2.0; use the 2.0 installer.
- Releases before 2.0 stay on PyPI as `agentguardproxy` and on npm as `@lictorate/agentguard`.
- Full steps: https://vanzik.lictorate.com/docs/migration#v1x-to-v20

## What problem it solves

Models with tools removed the gap between intent and action. A user typing `DELETE FROM users` is rare and reviewed; an agent constructing the same query is common and is not. Vanzik is the deterministic, auditable enforcement layer between the agent's decision and the system that carries it out, so a hijacked prompt never becomes a hijacked production system.

## Principles

1. **Authority before action.** Policy precedes action. No model output reaches a tool until the rules permit it.
2. **Defense in depth.** One prompt injection should not be catastrophic. Enforcement is the layer that contains the blast radius when alignment fails.
3. **Auditable enforcement.** Every decision visible. Every rule reviewable. Security teams should read code, not hope.

## Four enforcement paths

1. **MCP Gateway** (`vanzik-mcp-gateway`): wire-level. Sits between any MCP client (Claude Desktop, Cursor, Cline, Continue, Zed) and the real MCP server, local (stdio) or remote (Streamable HTTP, since 1.4.0); every `tools/call` is policy-checked before it reaches the server. No agent code changes.
2. **LLM API Proxy** (`vanzik-llm-proxy`): wire-level. HTTP checkpoint in front of the OpenAI and Anthropic APIs; set one base-URL environment variable and tool calls inside the response stream are gated (ALLOW / DENY / REQUIRE_APPROVAL), with streaming support.
3. **Coding-agent hooks** (`vanzik hook`): plug into the hook systems of Claude Code, Cursor, Gemini CLI and Codex CLI and check each agent's shell, file, web and MCP calls against the same policy.
4. **SDKs** (Python `vanzik` on PyPI, TypeScript `@lictorate/vanzik` on npm, both at 2.0.0): in-process compatibility tier with framework adapters for LangChain, CrewAI, browser-use, MCP, and (since 1.4.0) the OpenAI Agents SDK. Opt-in by design; use when you control the agent's source. Since 1.1.0 they can replay an approval through `/v1/check` (`approval_id`), so the one-shot / validity / cost-reservation semantics documented for that endpoint apply to SDK callers too.

All four share one policy, one audit trail, one approval queue.

## Key properties

- **Coding-agent hooks**: `vanzik hook claude-code|cursor|gemini-cli|codex` checks each coding agent's shell, file, web and MCP tool calls against the same policy; `--fail-closed` denies a call the hook can't check (since 1.4.0; Claude Code since 1.3.0). `vanzik setup` connects and disconnects each agent. Sessions link agents to the subagents they start, and the dashboard replays them.
- **Policy tests**: `vanzik test` runs a policy against YAML test cases in CI, including a coding agent's raw tool call as it sends it; JUnit output (since 1.4.0).
- **Human-in-the-loop approvals**: risky actions pause, notify Slack/webhooks, surface on a live dashboard (SSE feed, one-click approve/deny), and resume only after a human says yes. Since 2.0.0 every approve or deny is itself written to the audit trail, and the LLM API proxy resumes an approved action when the request is retried with an `X-Vanzik-Approval-ID` header.
- **Append-only audit trail**: JSONL with agent ID, scope, command, timestamp, reasoning; queryable by CLI, dashboard, or Prometheus. Since 1.2.0, secrets in requests (API keys, tokens, passwords, private keys, credential headers) are masked before they are written or shown. Since 1.4.0 the log can be sealed (`--audit-seal`; on by default for installs made with `vanzik setup`): each entry is chained to the previous one with an HMAC-SHA256, and `vanzik audit verify` checks it offline and reports the first edited, deleted or reordered `file:line`. The chain head is published as an anchor every 5 minutes; forward anchors or the log to WORM storage (S3 Object Lock, SIEM, syslog) so the newest entries can't be cut off unnoticed. `vanzik report` writes compliance evidence for a period (Markdown, JSON or HTML, with a SOC 2 mapping labelled as supporting evidence).
- **Fast**: 0.53 ms p99 measured end-to-end on the full HTTP check path with persistence enabled (1.0.0 verification); a CI gate fails the build of every release if p99 crosses 3 ms. On a three-node PostgreSQL cluster the concurrent hot-path p99 is 0.562 ms over 153,299 samples (1.1.0 verification).
- **Stateful, multi-tenant**: approval queue, rate limits, and cost accumulators persist to a zero-config embedded SQLite store (write-behind, off the hot path) or, for multi-node deployments, a PostgreSQL backend that shares approval, rate-limit, and cost state across replicas; per-tenant policies with isolated state. Write-once, one-shot approvals are enforced cluster-wide. v1.1.0 serialises schema migration across replicas with an advisory lock and gives every node the same row-lock order when flushing: 5,156,790 requests across three verification runs on a three-node cluster, zero errors and zero deadlocks.
- **Fail-closed gating**: a response the proxy cannot decode into a tool call, a stream that ends mid-tool-call, an orphaned tool input, and tool calls split across multiple OpenAI `choices` are all refused under stable `deny:llm_api_proxy:*` rule strings rather than forwarded unexamined. Refusals are written to the central audit trail, and are not subject to `--fail-mode allow`: that flag governs an unreachable guard, not a healthy guard that cannot see what the client will execute.
- **Policies match what runs**: since 1.2.0, a shell command containing `;`, `&&`, `||`, `|`, `$( )`, backticks or a redirection is split into the commands a shell would run, and each must pass the policy, so `allow: "ls *"` no longer covers `ls /tmp; rm -rf /`; redirection targets are checked as file writes. Several rule blocks for one scope are merged, and the MCP gateway checks the host of a tool's URL rather than a model-supplied `domain` argument. Since 1.4.0, commands hidden inside another shell or a wrapper (`bash -c`, `sh -lc`, `eval`, `env`, `sudo`, `timeout`, `xargs` and others) are checked as the commands they run, and domain rules match every spelling of a host (hex, decimal or octal IPv4, IPv4-mapped IPv6, full-width digits, a trailing dot).
- **Honest threat model**: Vanzik is a policy-enforcement and audit layer, not an OS sandbox; combine with OS-level isolation for hostile-agent threat models. Stated in full at https://vanzik.lictorate.com/docs/threat-model: actors in decreasing order of trust, trust boundaries, the fail-open versus fail-closed matrix, outbound connections, and explicit non-goals.
- **Frozen surface**: the additive-only guarantee has been hard since 1.0.0 and carries over to the 2.x line: policy schema, wire protocol, audit format, and CLI only gain fields, never break. 2.0.0's one break is the rename. Measured rather than asserted: the exported Go surface went from 525 identifiers at 1.0.0 to 549 at 1.1.0: 24 added, 0 removed.

## Data residency

Self-hosted; the runtime makes no outbound calls by default. Prompts, tool args, and results never leave your network unless you configure notifications or opt in to Vanzik Cloud.

## Pricing

- **Vanzik Core**: `$0` forever. Apache 2.0. Full policy engine, all four enforcement paths, approvals + dashboard, sealed append-only audit, policy tests, compliance reports, multi-tenant state on SQLite or multi-node PostgreSQL. Nothing in the enforcement path is held back for the paid tier.
- **Vanzik Cloud**: hosted, multi-tenant version; currently in design, waitlist open. Pricing announced at GA. The open core never gates on it.

## Roadmap

- **Q1 2026**: v0.1 open-sourced (Apache 2.0); v0.4 security hardening + conditional rules.
- **Q2 2026**: v0.5 wire-level enforcement (MCP gateway + LLM API proxy); v0.6 persistent multi-tenant state on SQLite.
- **v1.0**: PostgreSQL multi-node backend with shared approval, rate-limit, and cost state across replicas; additive-only guarantee hard for the 1.x line; write-once, one-shot approvals enforced cluster-wide.
- **v1.1**: fail-closed gating for every stream and response the firewall cannot evaluate; cluster hardening (advisory-locked migration, deadlock-free flush); approval replay in both SDKs; lifetime decision counters that survive a restart; a published threat model.
- **v1.2**: chained shell commands checked one command at a time; secrets masked in the audit trail by default; rule blocks for one scope merged, with `validate --strict` catching misspelled scopes; the MCP gateway checks a tool's URL host; `serve --bind` for a keyed server on one address.
- **v1.3**: prebuilt binaries and one-command installers for Linux, macOS and Windows that also update and uninstall, plus a multi-arch container image; `vanzik setup`, a menu to run, update or remove Vanzik; `vanzik server` as the command's name, with suggestions for mistyped commands and flags; a Claude Code hook.
- **v1.4**: hooks for Cursor, Gemini CLI and Codex CLI alongside Claude Code, each able to fail open or closed; a tamper-evident sealed audit log and `vanzik audit verify`; policy tests with `vanzik test`; session correlation and dashboard replay; `vanzik report` for compliance evidence; Streamable HTTP upstreams for the MCP gateway; an OpenAI Agents SDK adapter. Shell rules now see commands inside `bash -c`, `eval` and wrappers such as `sudo`, and domain rules match every spelling of a host.
- **Now (v2.0)**: AgentGuard is now Vanzik. `vanzik migrate --from-agentguard`, run by the installers and `vanzik setup`, moves a 1.x install, coding-agent hooks included; policies, audit logs and databases carry over unchanged. Approval decisions are audited, and the LLM API proxy resumes approved actions with `X-Vanzik-Approval-ID`.
- **Next (Cloud)**: Vanzik Cloud: hosted, multi-tenant control plane: same engine, run for you. Central dashboard + audit sync across your agent fleet. In design; waitlist open.

## Documentation

The full docs are on this site, one page per guide: https://vanzik.lictorate.com/docs

- [Setup](https://vanzik.lictorate.com/docs/setup): install, start the server, connect an agent
- [Coding agents](https://vanzik.lictorate.com/docs/coding-agents): Claude Code, Cursor, Gemini CLI and Codex CLI hooks
- [MCP gateway quickstart](https://vanzik.lictorate.com/docs/quickstart-mcp) · [LLM API proxy quickstart](https://vanzik.lictorate.com/docs/quickstart-llm-proxy)
- [MCP gateway](https://vanzik.lictorate.com/docs/mcp-gateway) · [LLM API proxy](https://vanzik.lictorate.com/docs/llm-api-proxy) · [Framework adapters](https://vanzik.lictorate.com/docs/adapters) · [Python SDK](https://vanzik.lictorate.com/docs/sdk-python)
- [Policy reference](https://vanzik.lictorate.com/docs/policy-reference): the YAML policy format and how a check is evaluated
- [Approval workflow](https://vanzik.lictorate.com/docs/approval-workflow) · [Dashboard](https://vanzik.lictorate.com/docs/dashboard) · [Compliance reports](https://vanzik.lictorate.com/docs/compliance)
- [Production deployment](https://vanzik.lictorate.com/docs/deployment) · [Operations](https://vanzik.lictorate.com/docs/operations) · [Observability](https://vanzik.lictorate.com/docs/observability) · [Troubleshooting](https://vanzik.lictorate.com/docs/troubleshooting)
- [CLI](https://vanzik.lictorate.com/docs/cli) · [HTTP API](https://vanzik.lictorate.com/docs/api) · [Wire protocol](https://vanzik.lictorate.com/docs/wire-protocol) · [File formats](https://vanzik.lictorate.com/docs/file-formats)
- [Threat model](https://vanzik.lictorate.com/docs/threat-model) · [Compatibility](https://vanzik.lictorate.com/docs/compatibility) · [Migration guide](https://vanzik.lictorate.com/docs/migration) · [FAQ](https://vanzik.lictorate.com/docs/faq)

## Citation

> Vanzik, by Lictorate: the open-source policy firewall for AI agents under Apache 2.0. Enforcement at the protocol boundary via an MCP gateway and an LLM API proxy; policy-as-code in YAML; append-only audit. https://github.com/lictorate/vanzik

## Related

- [About Vanzik](https://vanzik.lictorate.com/about): why it exists, its scope and limits, its history, and who builds it
- [Contact](https://vanzik.lictorate.com/contact): production rollouts, Vanzik Cloud, bugs, security reports, partnerships and press
- [Lictorate (parent company)](https://lictorate.com)
- [Thesis](https://lictorate.com/thesis)
- [Lictorate llms.txt](https://lictorate.com/llms.txt)
- [Docs](https://vanzik.lictorate.com/docs)
- [Threat model](https://vanzik.lictorate.com/docs/threat-model)
- [Coding agents (Claude Code, Cursor, Gemini CLI, Codex CLI)](https://vanzik.lictorate.com/docs/coding-agents)
- [Compliance reports and audit sealing](https://vanzik.lictorate.com/docs/compliance)
- [Release notes for v2.0.0](https://github.com/lictorate/vanzik/releases/tag/v2.0.0)
- [Upgrading from AgentGuard 1.x](https://vanzik.lictorate.com/docs/migration#v1x-to-v20)
- [Changelog](https://github.com/lictorate/vanzik/blob/master/CHANGELOG.md)
- [Compatibility & the additive-only guarantee](https://vanzik.lictorate.com/docs/compatibility)
- [Website privacy policy](https://vanzik.lictorate.com/privacy)