AgentFox 0.5: one-command setup and multi-agent systems scanned as their agents

AgentFox 0.5 is out. Most of it is about the first hour: getting from an agent you already have to an agent whose tool calls are checked, without reading the whole documentation first. The full list is in the changelog.

agentfox up: one command to a governed project

pip install -U agentfox
agentfox up

up scans the repository and then asks three things: where AgentFox runs (on this machine; on your own server, either started here with Docker Compose or one that already exists; or AgentFox Cloud), what to cover, and how strict to start. Then it does the work. It installs the Claude Code and Codex hooks, adds agentfox.auto() to your entry point, sets up the gateway environment for any other language, declares the tools it found (inferring each one's impact, and never overwriting a declaration you wrote), registers your MCP servers and opens the dashboard on the scan.

Every question has a recommended answer, and --yes takes them all. It starts in observe mode by default, so on day one nothing is blocked: you see what would have been, and switch to enforce when the verdicts look right. Run it again later and it only changes what is new.

We ran it end to end, on a sample project, locally, against a production-mode team server, through Cloud and as a Compose stack, and fixed what broke. A set-up agent now works on its first call instead of being refused by default-deny; a busy port is named before Docker starts; a second run no longer records the same scan twice.

Multi-agent systems, scanned as their agents

Until now, a repository with an orchestrator and four sub-agents came out of a scan as one agent holding every tool any of them used. That is the wrong shape for least privilege: the research agent should not hold the refund tool because the billing agent does.

The scan now reads each agent the code defines, the tools it is handed and which agent hands work to which: OpenAI Agents SDK handoffs and as_tool, LangGraph supervisors, swarms and StateGraph agent nodes, CrewAI crews and delegation, AutoGen teams and group chats, and Google ADK sub_agents. It does this statically, from the code, before the system has handled a request.

Each agent is proposed with its own tools, joined by the delegation edges the code declares. The guardrail map shows the sub-agents and the agent that calls each one, a policy applied to an orchestrator can be applied to its sub-agents in one step, and the whole system can be added with one Add all. agentfox scan --json gains agents and agent_edges for anything you build on top.

About seventy built-in validators

We ported about seventy checks from the Guardrails AI validator hub (Apache-2.0) as native code, so none of them needs its own install: system-prompt leaks, forbidden SQL and unknown columns, unsafe HTML, internal domains, fuzzy word lists, drug names, price quotes, format checks, local classifiers for jailbreaks, toxicity and gibberish, and LLM judges routed through the judgment tier.

In the dashboard, pick one under Policies → Add rule → Use a built-in check, give it its settings and try it on a sample. It is watched and enforced like any other rule. If you already have a Guardrails AI guard, importing it now maps each validator onto its port with the same settings. Your own validators register through the agentfox.validators entry point.

Hidden text in Unicode tags

A new default detector, unicode.tags, catches instructions hidden in Unicode tag characters: invisible to a person, read by many models. It runs on every surface and the injection rules you already have act on it. How the technique works and how the detector avoids flagging the flags of England, Scotland and Wales is in ASCII smuggling: prompt injection you cannot see.

Coding agents that keep their work

The coding-agent hook has always refused dangerous commands. In 0.5 it also catches a coding agent that is about to lose work it already got right: tearing down a deployment after a check passed, opening a damaged database before copying it, leaving a service the task needs attached to the session, or answering one question when the task asked for all of them. Each policy intervenes at most once or twice per session. The Claude Code adapter now binds Stop, so a refusal keeps the agent working with the reason as its next instruction.

Open core and AgentFox Enterprise

The repository is now an Apache-2.0 open core plus a source-available enterprise package. Everything that decides whether a call happens stays open: enforcement, containment, every detector and validator, custom rules, policy packs, retention and legal holds, and the audit trail. The enterprise package holds the compliance and oversight layer: compliance status, reviews and sign-off, the risk register and board view, auditor evidence packages, fleet monitoring with Slack alerts, and external access checks.

Enterprise is under the Business Source License 1.1. It is free in production for one workspace with up to four agents, and each release becomes Apache-2.0 three years after it ships. The open core never imports it, a contract in CI enforces that, and the open core's test suite runs without it. The details are on the pricing page.

Upgrading

pip install -U agentfox
agentfox admin hooks install --write   # coding agents: picks up the Stop hook

Self-hosted deployments pull the 0.5.0 images. Nothing in an existing policy needs changing; the new detector reports through the injection rules you already have. If you would rather try it before installing anything, the playground needs no account.