open source OWASP aligned
Agents are powerful. Nobody's securing them. SHAI is the missing layer.

SHAI sits between your agent and its tools, scanning every boundary, gating every tool call, enforcing policy, and producing a tamper-evident audit trail.
SHAI is a unique, open source security harness designed for any agent, any framework with full coverage of the OWASP Agentic AI threats

Explore SHAI See full OWASP coverage
Why SHAI exists

Agents are not chatbots anymore. They are execution systems.

Agents can write your code, manage your inbox, deploy your infrastructure, and make hundreds of autonomous decisions before you've had your morning coffee. The productivity is real. But so is the risk.

OpenClaw — the fastest-growing GitHub repository in history — became 2026's first major AI security crisis within weeks of going viral. One malicious webpage was enough to hijack an agent with full access to your files, emails, and credentials. Its plugin marketplace was 12% malware. Over 135,000 instances left exposed on the open internet. Good people, good intentions — but no security layer.

That's the gap every agent has right now.

AI agents are a fundamentally new kind of security problem. A traditional app has a fixed attack surface. An agent's grows with every tool, every integration, every new capability you give it. OWASP recognized this and published the first-ever security framework for AI agents — ten threat categories specific to autonomous systems: prompt injection, memory poisoning, supply chain compromise, rogue agents, and more. A clear map of what can go wrong.

Nobody had built a security layer to actually prevent it.

Until SHAI.

SHAI is not an agent itself, is the security harness that wraps around one. You keep building with whatever framework you love: LangChain, LlamaIndex, CrewAI, or your own custom loop. SHAI sits around it and protects it, covering every threat on the OWASP Agentic AI list. It works on new agents you're building today, and on existing ones already running in production.

The Secure harness

The harness around the agent loop.

Think of SHAI as a seatbelt for your agent. You still drive. You still build however you want — LangChain, LangGraph, CrewAI, PydanticAI, Anthropic SDK, or your own custom loop. SHAI wraps around it and makes sure nothing goes wrong along the way.

One Python package. pip install shai That's it.

The idea is simple

Every agent follows the same pattern: user sends a message → LLM thinks → LLM calls a tool → tool returns a result → LLM responds.

SHAI places a security checkpoint at every one of those transitions — before the LLM, before the tool, after the tool, and before the response goes back to the user.

Nothing gets through without being checked. Every check generates an audit event. Every audit event is signed and tamper-proof.

The architecture

SHAI harness diagram

Works with agents you're already running

You don't need to rebuild anything. SHAI ships with native integrations for every major framework:
LangGraph LangChain CrewAI Anthropic SDK PydanticAI OpenAI Agents

If you already have an agent running in production, SHAI can protect it today, without changing your agent logic.

SHAI doesn't replace your agent framework. It completes it.

OWASP coverage

Built around OWASP Agentic AI Threats by design.

SHAI maps concrete controls to concrete threats across input, tool use, tool return, output, and audit.

Goal & instruction hijacking

Partial

Two independent intercepts — before the LLM and at the tool gate.

17 rules catch instruction overrides, role spoofing, and delimiter smuggling before a single token is processed. If anything slips through, the L1 gate blocks any undeclared tool from firing.

Tool misuse

Full

Four-layer gate on every tool call, no exceptions.

Allowlist → capability tags → policy intersection → argument scan. All four must pass before any tool fires.

Uncontrolled agent actions

Full

Every agent operates inside an explicit capability envelope it cannot escape.

Subagents inherit a scoped subset of their parent's permissions — read-only stays read-only, no matter what the LLM requests.

Resource overload

Full

A sliding-window rate limiter on every tool call, per agent and per tool.

Two independent call budgets — global and per-tool — keep runaway loops from doing real damage.

Direct prompt injection

Full

scan_input intercepts attacks before the LLM sees them.

17 rules covering jailbreaks, encoded payloads, homoglyph obfuscation, and tool coercion — configurable threshold per boundary.

Indirect prompt injection

Full

scan_tool_result stops poisoned tool output before it re-enters context.

The checkpoint most harnesses miss. Every document, search result, and API payload is scanned before the LLM ingests it.

Repudiation & untraceability

Full

Every boundary leaves one structured, signed audit event.

HMAC-SHA256 signed, SIEM-ready, scrubbed of raw content. A complete step-by-step record of what your agent did and why.

Privilege escalation

Full

Subagents cannot reach beyond the scope they were explicitly given.

Least privilege, enforced at runtime. Not through the LLM, not through policy — not at all.

Sensitive data exposure

Full

PII scanning at three independent checkpoints — input, tool arguments, and output.

Emails, phones, SSNs, credit cards — detected, redacted, never logged. Block, alert, or scrub in-place per boundary.

Data exfiltration

Partial

scan_output checks the agent's response before it reaches the user.

Catches credentials that slipped into the narrative. Network-layer controls coming in shai-connectivity.

Supply chain compromise

Partial

MCP servers, plugins, and integrations are gated before activation.

Untrusted sources are suppressed. Secrets live behind secret:// URIs — never hardcoded, never logged.

This is not generic AI safety language. It is executable security architecture covering every threat in the OWASP Agentic AI framework. There is no comparable open source secure harness with this level of coverage across the full execution path.

Get started

Secure your agent in minutes.
Start building secure agents today.


Pick a template. Drop SHAI in. Your agent stays unchanged — the security layer wraps around it.

To help to get up to speed quickly, SHAI ships interactive documentation as a set of skills that will answer all your questions.

quickstart

LangGraph

get started -> quickstart

LangChain · CrewAI

get started -> quickstart

Anthropic SDK

get started -> quickstart

PydanticAI

get started -> quickstart

OpenAI Agents

get started -> quickstart

Custom loop

get started ->
Differentiation

There is no other secure harness

Agent frameworks are racing to make tools easier to call. SHAI is focused on the thing production teams actually need next: making those calls safe, scoped, inspected, auditable, and enforceable.

SHAI

An independent open-source project. No managed service, sign-up, no keys. Brought to you by AIBestlabs

Architecture OWASP Coverage Get Started Docs GitHub

Discover more with AI: talk with the documentation!


© SHAI by AIBestLabs.com. All rights reserved.