SAFEAGENTS

Summary from the TLDR InfoSec newsletter

safeagents is a local proxy that sits between a coding agent and its model API and checks each tool call before the harness runs it. It blocks calls to undeclared tools and calls that reach hosts nobody mentioned in the conversation, and it runs atif-scan detectors that catch reads of /proc/1/environ or curl --noproxy. Ambiguous calls can go to an optional judge model that sees only the user's prompt, the call, and the findings, never the agent's reasoning, and it works with any harness that accepts a custom base URL, including Claude Code, OpenCode, and Hermes.