v0.1.0

First public release of OpenWAF Egress, a gateway between AI agents and model providers. Agents
hold a placeholder token; the gateway checks each request and only then reads the real key from
OpenBao or HashiCorp Vault and sets it on the outgoing request.

What is in it

• Credential injection: per-agent OWE_TOKEN_… placeholders, real keys read from KV v2
  (AppRole login, 5 min cache) per agent and target, never written to the agent's environment.
• Target allowlist per agent; every other destination gets 403 egress_blocked.
• Prompt injection: 27 deterministic detectors in English and Spanish (21 pattern detectors,
  6 for hidden or encoded text). No model call. 403 injection_detected.
• Data leaks: Luhn-valid card numbers, PEM private keys, AWS access key IDs, sk- keys and
  GitHub tokens. 403 data_leak_blocked.
• SSRF: the target must resolve only to public addresses, and upstream redirects are never
  followed (the 3xx goes back to the agent without the credential).
• No partial inspection: inline base64 media is not inspected text; the rest must fit the
  1 MiB window or the request gets 413 body_too_large (bodies capped at 8 MiB).
• Streaming responses pass through unchanged.

Performance

Measured on Apple Silicon (darwin/arm64): 84 µs to inspect a 4 KB chat request, 1.3 ms for
64 KB; worst case (every detector keyword present) about 97 ms per 64 KB.

Install

docker pull ghcr.io/openwaf-dev/egress:0.1.0   # linux/amd64, linux/arm64
egress -version

Binaries for Linux and macOS (amd64, arm64) are attached with SHA256SUMS.

Limits

• Plain HTTP with static agent tokens: run it on loopback or a private network, or put TLS in front.
• Detection is pattern matching: it stops known injection and exfiltration shapes, it does not
  prove a request is safe.

Apache-2.0. Vulnerabilities: security@openwaf.dev.