Invariant Guardrails
Rule-based security layer for LLM and MCP agents that intercepts traffic to catch prompt injection, PII, secrets, and tool poisoning
Overview
Invariant Guardrails is a rule-based security layer for LLM- and MCP-powered agents, built by Invariant Labs, an ETH Zurich spin-off founded in 2024 by professors Martin Vechev and Florian Tramèr along with three of their graduate students. Guardrails is deployed transparently between an application and its MCP servers or LLM provider, intercepting tool calls and model traffic before or after execution to detect prompt injection, PII, secrets, copyrighted material, tool-poisoning attacks, and other harmful or unwanted content, all expressed through a Python-inspired policy language. It ships alongside two companion open-source projects: Invariant Gateway, a lightweight LLM/MCP proxy used to enforce Guardrails rules at runtime and trace agent behavior, and MCP-Scan, a dedicated scanner that audits installed MCP servers for prompt injection in tool descriptions, tool-poisoning attacks, and cross-origin (tool-shadowing) escalations. In June 2025, less than a year after founding, Invariant Labs was acquired by Snyk and now operates as part of Snyk Labs, feeding into Snyk's broader AI Trust Platform; the core Guardrails and Gateway repositories remain open source under Apache 2.0, while MCP-Scan has since been rebranded and continued under Snyk as "agent-scan."
The Verdict
Who Should Use Invariant Guardrails?
Best For
- Teams building MCP-connected agents that need to intercept and vet tool calls, not just chat messages
- Developers who want a transparent proxy layer (Gateway) rather than rewriting application code to add guardrails
- Organizations wanting a self-hosted, rule-based policy engine with a Python-like DSL for custom detection logic
- Security teams that also want to periodically scan installed MCP servers for tool poisoning via MCP-Scan / agent-scan
Not Ideal For
- Teams wanting a fully independent vendor unaffected by post-acquisition roadmap or pricing changes under Snyk
- Non-MCP, single-turn chatbot use cases where a lighter input classifier would suffice
- Projects that need a very large, battle-tested community project—Guardrails and Gateway are still relatively small compared to some alternatives
What's Great
- Purpose-built for MCP: detects prompt injection in tool descriptions, tool-poisoning attacks, and cross-origin/tool-shadowing escalations, gaps most general-purpose guardrail tools miss
- Transparent proxy deployment (Gateway) means no invasive code changes to the agent or LLM client
- Rule/policy language covers PII, secrets, copyrighted content, prompt injection, and harmful content in one framework
- Backed by security researchers with a strong publication track record on MCP vulnerabilities (e.g., the GitHub MCP exploit, tool-poisoning disclosures)
- Core Guardrails and Gateway code is open source under Apache 2.0 and self-hostable
Watch Out For
- Now owned by Snyk following the June 2025 acquisition; long-term product direction, pricing, and open-source commitment could shift as it's folded into Snyk's AI Trust Platform
- MCP-Scan has already been renamed/relocated to "agent-scan" under the Snyk GitHub org, signaling active restructuring of the project family
- Smaller community than some competing guardrail frameworks—both Guardrails and Gateway are modest in size relative to adjacent security tooling
- Hosted/managed features (Explorer, dashboards) sit alongside the OSS core, so getting full value may require the commercial platform
Pricing
View all features & details
Key Features
- Transparent MCP/LLM proxy (Invariant Gateway) that intercepts traffic before/after execution without code changes
- Python-inspired rule/policy language for custom guardrail logic and if-this-then-that style controls
- PII and secrets detection across agent conversations and tool outputs
- Prompt injection detection, including indirect injection hidden in tool descriptions or retrieved content
- Tool-poisoning and cross-origin/tool-shadowing escalation detection via companion MCP-Scan (now agent-scan)
- Static code analysis, image OCR, and HTML parsing to catch hidden threats in agent interactions
- Copyright and harmful/unwanted content detection
Use Cases
- Adding a security/observability layer between an agent and its MCP servers without modifying the agent's code
- Blocking tool-poisoning and prompt-injection attacks embedded in MCP tool descriptions or server responses
- Auditing installed MCP servers (Claude Desktop, Cursor, Claude Code, Gemini CLI, etc.) for known vulnerability classes
- Enforcing data-flow rules, e.g., preventing PII or secrets from crossing between tools or leaving the agent boundary
- Debugging and tracing agent/tool call behavior via the Gateway's logging and Explorer integration
How It Compares
| Feature | Invariant Guardrails | LlamaFirewall | Bifrost |
|---|---|---|---|
| Deployment | Transparent MCP/LLM proxy (Gateway) | Self-hosted Python SDK | Self-hosted proxy |
| MCP-Specific Threat Detection | Tool poisoning, cross-origin escalation, injected tool descriptions (via MCP-Scan/agent-scan) | Not MCP-specific | Not MCP-specific |
| Policy Language | Custom Python-inspired rule DSL | Configurable scanners + regex | Config-based routing rules |
| PII / Secrets Detection | Yes | Limited (regex/custom scanners) | Varies by plugin |
| Code / Reasoning Auditing | Static code analysis, OCR, HTML parsing | AlignmentCheck (chain-of-thought auditing) | No |
| License | Apache 2.0 (core repos) | MIT (framework); Llama Community License (models) | Apache 2.0 |
| Backing | Snyk (acquired Invariant Labs, June 2025) | Meta (Purple Llama) | Independent / VC-backed |