How-to: Protect LangChain agents with langchain-agent-memory-guard (5 minutes)

[vgudur-dev]

Why

Persistent agent memory / tool outputs are an ASI06 attack surface. OWASP Agent Memory Guard ships a LangChain middleware package so you can wrap an agent without rewriting your memory store.

• Core: agent-memory-guard
• Wrapper: langchain-agent-memory-guard (PyPI 0.1.0)
• Clinic (core Policy.strict repro): https://gist.github.com/vgudur-dev/ead8817d2f4df08c04b808cc5b53eb06
• Integration folder: https://github.com/OWASP/www-project-agent-memory-guard/tree/main/integrations/langchain-agent-memory-guard

Install

pip install langchain-agent-memory-guard
# pulls agent-memory-guard>=0.2.2 and langchain>=0.3.0

Quick start (middleware)

from langchain.agents import create_agent
from langchain_agent_memory_guard import MemoryGuardMiddleware

agent = create_agent(
    "openai:gpt-4o",
    tools=[...],  # your tools
    middleware=[MemoryGuardMiddleware()],  # default: block on violation
)

result = agent.invoke({"messages": [("user", "Search for recent news")]})

Violation modes

MemoryGuardMiddleware(on_violation="block")  # default — raises
MemoryGuardMiddleware(on_violation="warn")   # log, continue
MemoryGuardMiddleware(on_violation="strip")  # remove violating content

Optional: Policy.strict()

from agent_memory_guard import Policy
from langchain_agent_memory_guard import MemoryGuardMiddleware

middleware = MemoryGuardMiddleware(policy=Policy.strict())

(Custom Policy / protected keys: see the integration README.)

What gets scanned

Hook	Scans	Threat
before_model	messages in state	injection in memory/context
after_model	model response	secret leakage / injection propagation
wrap_tool_call	tool output	injection via tools (primary vector)

Alternate path: GuardedChatMessageHistory

If you only need guarded chat history (not full middleware):

from agent_memory_guard import MemoryGuard, Policy
from agent_memory_guard.integrations import GuardedChatMessageHistory

history = GuardedChatMessageHistory(
    session_id="sess-1",
    guard=MemoryGuard(policy=Policy.strict()),
)

Try the clinic, then leave an Adopter note

1. Run the public clinic Gist (~15 min).
2. Open a GitHub issue titled Adopter: <name> — LangChain with stack versions + what was blocked/allowed.
3. Optional: comment here with feedback on the middleware API.

Non-claims

Not an OWASP certification. Not MITRE approval. Public Apache-2.0 project only.

---