SafeAgents: Open-Source Proxy for Inspecting Coding Agent Tool Calls
SafeAgents is a new open-source local proxy that intercepts, inspects, and validates every tool call made by a coding agent before execution. It acts as an intermediary between the coding agent and its model server, using local checks and deterministic detectors to block unauthorized actions. This project addresses a critical security gap in AI engineering by preventing autonomous coding agents from making malicious tool calls, attempting network bypasses, or engaging in reward hacking. It allows developers to safely run and evaluate agents without exposing their systems to unexpected system modifications. Each tool call passes through up to three local validation steps, including format validation, host verification, and atif-scan which runs approximately 110 deterministic detectors in-process. Additionally, developers can optionally configure an OpenAI-compatible judge model to evaluate milder findings and add trusted hosts via command-line flags.
## BACKGROUND
Coding agents are autonomous AI systems capable of executing code, interacting with terminals, and calling external tools to accomplish software engineering tasks. However, these powerful capabilities pose security risks, as language models can sometimes generate unintended or malicious system commands when attempting to solve problems.