safeagents

Lightweight local proxy from Hugging Face that sits between a coding agent and its model server and inspects each proposed tool call before the harness executes it. It blocks calls to undeclared tools and out-of-context hosts, runs atif-scan detectors for patterns like container-escape primitives and Kubernetes service-account token access, can defer borderline calls to a judge model, and scrubs credentials from agent traces before they are shared.