Zero Trust Agents

The definitive security and observability control plane for Autonomous AI Agents.

Quickstart • Features • Architecture • MCP Protocol • Documentation • Enterprise Edition

---

Why ZeroTrust Agents (ZTA)?

As AI Agents become increasingly autonomous (executing SQL, calling external APIs, writing to databases), organizations need a centralized security layer to prevent rogue actions, ensure compliance, and monitor AI behavior in real time.

ZeroTrust Agents (ZTA) acts as an enterprise-grade API Gateway that sits securely between your AI Agent and its LLM provider (OpenAI, Anthropic, Gemini, etc.). It intercepts the agent's attempts to use tools and evaluates those actions against a strict, zero-trust security policy engine before allowing them to execute.

Features

• LiteLLM Proxy Engine: Agnostic proxy that intercepts traffic and forces LLMs to adhere to predefined tool-use policies. We support the OpenAI, Anthropic, and Gemini tool-use specification formats natively.
• Semantic DLP & Secret Scanning: Scans arguments sent to tools for destructive commands (e.g., DROP TABLE), PII, and leaked API Keys/Secrets using secondary lightweight local LLMs and Regex fallback.
• Human-in-the-Loop (HITL): Suspend high-risk agent operations until a human administrator clicks "Approve" or "Block" in the visual dashboard.
• Auto-Discovery Graph: Automatically maps and visualizes the relationships between your AI agents and the external tools they are trying to use.
• Model Context Protocol (MCP): Native support for Anthropic's MCP, allowing you to proxy MCP tool calls natively through the gateway.
• Python SDK & CLI (zta): Official SDK (zerotrust-agents-sdk) to interact programmatically with the Firewall control plane, complete with a powerful CLI tool to sync policies, apply predefined security templates (e.g. safe_github), and manage approvals.
• Real-time Alerts: Instantly fire webhooks to Slack or Discord whenever an agent attempts a high-risk action requiring Human-in-the-Loop approval.
• Multi-Tenancy Setup: The entire architecture is partitioned by tenant_id. Built from the ground-up to support SaaS deployments or internal enterprise isolation.
• Interactive Security Labs: Includes a sandboxed, containerized environment with automated Red-Teaming scripts to safely test prompt injections and data exfiltration evasions locally!
• Completely Offline: Can be run entirely offline or air-gapped without relying on any external cloud backends.

Authentication & API Keys

ZeroTrust Agents is completely self-hosted, meaning you control the keys!

• The Master Key: In your .env file, there is a SECRET_KEY. This is your admin key used to authenticate the zta CLI and Python SDK with your local Control Plane.
• Agent API Keys: The system automatically seeds a "Default Organization" with the API key sk-default. Your agents use this in their Authorization: Bearer sk-default headers when talking to the Gateway.

Quickstart

Getting started is easy. You can run the entire ZeroTrust Agents stack (Gateway, API, Database, and Dashboard) locally with a single command.

1. 1-Click Launch

We provide an interactive launcher that manages dependencies for you.

git clone https://github.com/lokeshsk/zerotrust-agents.git
cd zerotrust-agents
chmod +x start.sh

# Run the interactive setup!
./start.sh

2. Install the CLI & SDK

Manage your firewall directly from the terminal.

pip install zerotrust-agents-sdk

# Login using the SECRET_KEY from your .env
zta login my-super-secret-key --url http://localhost:8001

3. Apply a Security Template

# Instantly secure an agent by blocking destructive SQL queries
zta templates apply read_only_sql --agent-id data-analyst-agent

4. Route your Agent Traffic

In your AI application (e.g. using LiteLLM, LangChain, or OpenAI SDK), point the base URL to the Gateway and pass the default tenant API key:

from openai import OpenAI

# The firewall acts as a proxy, so you use your Gateway's URL
client = OpenAI(
    api_key="sk-default", # The default Tenant API Key
    base_url="http://localhost:8000/v1"
)

Once booted, open the Dashboard at: http://localhost:3000 (or your custom APP_URL).

Environment Variables

Upon first launch, ./start.sh automatically copies .env.example to .env. Open .env and set your Upstream API Keys so the Gateway can route requests for your agents:

OPENAI_API_KEY="sk-your-openai-key"
ANTHROPIC_API_KEY="sk-ant-your-anthropic-key"
APP_URL="http://localhost:3000"

Architecture

graph TD
    A[Autonomous AI Agent] -->|Tool Call Request| G[ZeroTrust Agents Gateway]
    
    subgraph Control Plane
    G <-->|Policy Check| API[FastAPI Server]
    API <--> DB[(PostgreSQL)]
    end

    subgraph External
    G -->|If Allowed| LLM[OpenAI / Anthropic]
    end
    
    D[Admin Dashboard] --> API

Loading

1. Gateway (apps/gateway/): A high-performance proxy written in Python/FastAPI. Intercepts agent traffic, runs anomaly detection, extracts requested tool invocations, evaluates policies, and queries the Control Plane.
2. API Control Plane (apps/api/): A backend managing Workspaces, Policies, Audit Logs, and pending HITL approvals.
3. Dashboard (apps/web/): A Next.js 15 frontend App Console utilizing Tailwind CSS and a premium dark-mode aesthetic.
4. Website & Docs (apps/website/ and apps/docs/): Next.js applications that serve the main landing page and Fumadocs-powered documentation, tied together using Next.js Multi-Zones.

MCP (Model Context Protocol)

ZTA natively supports Anthropic's Model Context Protocol (MCP). Instead of giving LLMs unmitigated direct access to your local filesystem or databases, you can route your MCP connections through the Firewall. The Gateway intercepts the JSON-RPC messages, inspects the CallToolRequest, and blocks actions like write_file or execute_query based on your policies, all while keeping the connection stateful.

Documentation

Comprehensive documentation is available for deployment, configuration, and writing custom Semantic DLP plugins. To run the documentation locally:

turbo run dev --filter=docs

Open Source vs Enterprise Edition

ZeroTrust Agents (ZTA) operates on an Open Core model.

• Community Edition (Source-Available - BSL 1.1): Includes the core firewall proxy, semantic DLP, basic HITL flows, multi-tenant workspaces, and master key authentication. Free for all use-cases except offering a managed gateway service. Converts to Apache 2.0 after 4 years.
• Enterprise Edition (EE - Commercial): Distributed privately for enterprise customers. Unlocks:
  • Auth0 / Active Directory SSO: Centralized identity with Just-in-Time (JIT) provisioning.
  • Granular RBAC: Enforce precise permissions (e.g., policies:write) within workspaces.
  • Active Data Redaction (Masking): Automatically mask SSNs and API keys in tool payloads without breaking agent flows.
  • Advanced SIEM Webhooks: Forward structured logs to Splunk or Datadog.
  • Hard Budget & Cost Controls: Set granular financial limits (in cents) per agent. Automatically block LLM requests with 402 Payment Required when budgets are exhausted.
  • SOC2 Audit Trails: Immutable before-and-after snapshots of all administrative actions, easily accessible via the API or CLI (zta audit-trail).

If you are interested in an Enterprise License, please visit our website at zerotrust-agents.com.

---

Built with ❤️ for secure AI.