Agent Guard 1.2.0

Agent Guard 1.2.0

Agent Guard now works out of the box with the model providers and agent frameworks people
use. A new package, @shieldaai/agent-guard-adapters, connects the guard to Claude, OpenAI,
Gemini, Bedrock, the Vercel AI SDK, the OpenAI Agents SDK, LangChain and any MCP client.
@shieldaai/agent-guard, -mcp, -scenarios, -executor and the experimental
@shieldaai/agent-map are unchanged apart from their version. All six packages move to
1.2.0 together.

Why

Before 1.2.0, every application had to write the same code to use the guard with a model:
a dispatcher that sends each tool call through prepare and execute, a place where
actions wait for a person, a check of the model's arguments, and a conversion between the
guard's results and each provider's tool-call format. The only ready-made integration was
MCP. That code is easy to get subtly wrong, for example by showing the model a tool
definition nobody approved, or by passing a host error message to the model. 1.2.0 ships it
once, tested, for each integration.

What is new

Integrations

Integration	Adapter
Anthropic Messages API (Claude)	anthropicTools, anthropicToolResults
OpenAI Responses API	openAIResponsesTools, openAIResponsesToolOutputs
OpenAI Chat Completions and compatible APIs (Groq, Mistral, OpenRouter, vLLM, Ollama, ...)	openAIChatTools, openAIChatToolMessages
Google Gemini (@google/genai)	geminiTools, geminiFunctionResponses
Amazon Bedrock Converse	bedrockTools, bedrockToolResults
Vercel AI SDK	aiSdkTools
OpenAI Agents SDK	openAIAgentsTools
LangChain.js and LangGraph.js	langChainTools
Claude Code, Claude Desktop, Cursor, VS Code, the Claude Agent SDK (MCP clients)	registerMcpServerTools, mcpServerTools
OpenTelemetry, JSON log shippers	openTelemetryDecisionHook, jsonLinesDecisionLogger
Zod, Valibot, ArkType (Standard Schema)	standardSchemaParser

The adapters package has no third-party runtime dependencies. Framework adapters take the
framework's own factory function as an argument (for example tool from @openai/agents),
so it never pins a framework version.

Building blocks

• One dispatcher (createDispatcher). Every outcome is one of four statuses:

  • ok: the call ran;
  • denied: nothing ran, with a message that tells the model what to do next;
  • waiting_for_approval;
  • failed: the effect is unknown.

  Errors from host code are reported to your onHostError hook. The model gets HOST_ERROR
  without detail. The dispatcher works with the core guard, the durable executor and the
  executor's task client.

• An approval queue (ApprovalQueue) for actions that wait for a person.

  • Each task gets its own share of the queue.
  • Actions of a revoked or expired task are dropped.
  • Dispatchers can return at once, or wait for the decision with a time limit.

• Tools the model sees are the ones you approved. toolSpecs reads names, descriptions
  and schemas from the guard's approved registrations. registerApprovedTools can pin
  fingerprints, so a changed tool fails start-up. defineTool types a tool's arguments.

• Argument checks from the same schema the model sees. jsonSchemaParser enforces a
  JSON Schema as the tool's parse. It refuses unsupported keywords, and regular expressions
  that can take exponential time, when the parser is built.

• Policies. combinePolicies with denyTools, requireApprovalForTools,
  requireApprovalForExternal, requireApprovalAfterUntrusted, withinHours, denyWhen and
  requireApprovalWhen. RateLimiter limits a tool across all tasks of a tenant or principal.

• An agent-guard-explain command that explains any denial code.

Documentation and examples

• Connect your model or framework: every integration, with the
  few lines each one needs.
• The README leads with the integrations table.
• examples/model-adapters.mjs runs one model turn in
  five provider formats. examples/mcp-guarded-server.mjs
  is an MCP server with guarded tools, for example for Claude Code. Both run offline.
• Support and limits lists
  what the adapters do not do.

Upgrading from 1.1.1

Nothing changes for existing code. Move every Agent Guard package you use to 1.2.0 and, to
use the integrations, add @shieldaai/agent-guard-adapters@1.2.0.

Known limits

• ApprovalQueue and RateLimiter keep their state in memory, in one process. A restart
  drops pending approvals (nothing runs) and resets rate counts.
• A rate limit can be exceeded by the number of calls already in flight when it is reached.
• The check for exponential regular expressions is deliberately cautious. It refuses some
  safe patterns, such as ^[a-z]+(\.[a-z]+)*$, unless allowNestedQuantifiers is set. It
  does not detect overlapping alternatives such as (a|a)+.
• The provider adapters were run against the providers' request and response formats and
  type-checked against their official SDKs, not against live endpoints.
• The limits of 1.1.0 and 1.0.0 still apply.

Verification

Run locally before the pull request:

• npm run check: 1,968 tests, 0 failed, 11 skipped (Docker, Linux-only and Windows-only
  cases). The packed packages pass in a clean project. That includes the adapters README
  example compiled with strict TypeScript.
• scripts/verify-adapters-real-packages.mjs passed:
  • It ran the adapters against ai 7.0.173 (a full generateText loop), @openai/agents
    0.22.0, @langchain/core 1.4.1 with @langchain/langgraph 1.7.4, and zod 4.6.7.
  • It type-checked the provider adapters against @anthropic-ai/sdk 1.8.0, openai 7.57.0,
    @google/genai 3.3.0 and @aws-sdk/client-bedrock-runtime 3.1169.0.
• The MCP adapter ran with a real MCP client and server (MCP TypeScript SDK 2.4), in memory
  and over stdio.

CI and CodeQL must pass on the pull request and on the merge commit before publishing
(releasing, step 5).