---
type: "post"
id: "hugging-face-open-sources-safeagents-a-local-proxy-c6d60e"
slug: "hugging-face-open-sources-safeagents-a-local-proxy-c6d60e"
title: "Hugging Face open-sources safeagents, a local proxy that checks every agent tool call before it runs"
description: "Hugging Face has open-sourced safeagents, a local proxy that inspects an agent’s tool calls before its coding harness can execute them."
retrieval_nugget: "Hugging Face has open-sourced safeagents, a local proxy that inspects an agent’s tool calls before its coding harness can execute them. For teams deploying coding agents, it offers a deployable control point between the model response and filesystem, shell, or network actions—without requiring a new harness."
published_at: "2026-10-29"
updated_at: "2026-10-29"
record_date: "2026-10-29"
date_kind: "published_at"
topics: ["anthropic","claude","claude-code"]
entities: ["Hugging Face","safeagents","atif-scan","Claude Code","OpenAI Chat Completions","Anthropic Messages","safeagents-judge-bench"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","harness-architecture-outlives-model-choice"]
novelty_label: "new_fact"
what_changed: "Hugging Face has open-sourced safeagents, a local proxy that checks agent tool calls before execution; the priors cover an earlier agent-security incident, not this release."
prior_refs: ["memory:ce5d0d5c-9645-827f-a4ff-8d314184270a","memory:ef41394e-25f2-8898-aed6-16aa0e5582a1","memory:940b9e59-adf9-822f-a755-9b68d30a6574"]
source_url: "https://github.com/huggingface/safeagents"
source_urls: ["https://github.com/huggingface/safeagents"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:hugging-face-open-sources-safeagents-a-local-proxy-c6d60e"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/hugging-face-open-sources-safeagents-a-local-proxy-c6d60e/","markdown":"https://newruntime.com/posts/hugging-face-open-sources-safeagents-a-local-proxy-c6d60e.md","json":"https://newruntime.com/posts/hugging-face-open-sources-safeagents-a-local-proxy-c6d60e.json"}
---

# Hugging Face open-sources safeagents, a local proxy that checks every agent tool call before it runs

## Retrieval answer

Hugging Face has open-sourced safeagents, a local proxy that inspects an agent’s tool calls before its coding harness can execute them. For teams deploying coding agents, it offers a deployable control point between the model response and filesystem, shell, or network actions—without requiring a new harness.

## Summary
Hugging Face has open-sourced safeagents, a local proxy that inspects an agent’s tool calls before its coding harness can execute them. For teams deploying coding agents, it offers a deployable control point between the model response and filesystem, shell, or network actions—without requiring a new harness.

## What happened
Hugging Face published safeagents as an Apache-2.0-licensed open-source project. The repository describes it as a lightweight local proxy placed between an agent and its model server. Rather than trying to change how an agent reasons, it intercepts tool calls in the model response before the coding harness receives them. When safeagents blocks a call, it replaces that call with a text notice, so the harness has nothing executable to run.

The project is intended for coding-agent harnesses that allow a user to change the model API base URL. The README names Claude Code, Pi, Hermes, and OpenCode as examples. It supports the OpenAI Chat Completions and Anthropic Messages interfaces, both with and without streaming. A basic setup starts a local proxy pointed at an upstream provider endpoint, then starts the agent with its base URL set to the proxy. The project provides installation scripts for macOS, Linux, WSL, and PowerShell; it also documents setup guides for 13 coding agents.

Safeagents evaluates calls in three stages. First are request-only checks. A call can be blocked when it invokes a tool that the request did not declare, or when its arguments contain a URL or bare IP address that appears nowhere in the conversation. The agent’s previous messages do not count for this comparison. Second, safeagents turns the conversation into an ATIF trace and runs detectors from `atif-scan` against the pending call. The repository gives examples including reading `/proc/1/environ`, using `curl --noproxy`, accessing a Kubernetes service-account token, and using `unshare` or `nsenter`. Findings at or above the configured block severity—high by default—are blocked; lower-severity findings mark a call as suspicious.

The third layer is optional: a decision model can judge suspicious calls as allow or block. It can add a block, but it cannot overrule a previous block; calls without scanner findings do not reach it. Hugging Face says the judge receives only the user-written content, the tool call, and findings, not the agent’s reasoning or tool results. That design is meant to avoid letting an agent use its own hidden reasoning to argue for executing a call. The project includes `safeagents-judge-bench`, a benchmark of 562 scanner-flagged real agent tool calls labeled allow or block and categorized by misuse, such as reward hacking, harness introspection, and credential misuse.

The proxy can start in `--log-only` mode, reporting what it would have blocked without stopping execution. In blocking mode, it retains suspicious, flagged, and blocked calls in a local JSONL file readable only by the local user, because call arguments may contain secrets. A foreground session displays live verdict counts and recent calls; a background proxy writes corresponding logs. The README states that `atif-scan` takes roughly 10 to 20 milliseconds per call on an M-series Mac. In streaming mode, text continues to flow as it arrives, while each tool call is held until its arguments are complete and then either released unchanged or replaced.

## What the archive adds
This is a new implementation on a known security problem. Our earlier Field Note, [Agent sandboxes have become a critical boundary](https://newruntime.com/posts/agent-sandboxes-have-become-a-critical-boundary-because-2df4bb/), argued that agent security depends on runtime boundaries rather than task wording or a sandbox label. Safeagents adds a distinct pre-execution boundary at the tool-call interface.

## Trend signal
This materially supports [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The important mechanism is not a prompt telling an agent to be careful: it is an intercepting process that can observe a proposed call and prevent the harness from executing it. That boundary is portable across compatible coding harnesses because it sits on the model API path.

## Connections to other events
The archive’s sandbox note focused on the broad execution environment: package installation, commands, files, and external services. Safeagents is narrower and complementary. It does not replace isolation or permissions; it examines the model-to-harness transition before a requested tool action is handed to that environment.

## Why it matters
Coding agents make useful work possible by receiving powerful tools: shells, repositories, local files, credentials, and web access. Those same tools make a single unsafe call consequential. Teams often face an awkward choice between restricting the environment so much that an agent cannot help, or granting broad access and relying on prompts, reviews, and logs after the fact.

Safeagents offers a third operational layer: inspect individual proposed actions before execution. Its request-only checks can constrain surprise tool or destination use; its scanner catches specified misuse signatures; and its optional judge concentrates human-selected model judgment on ambiguous cases rather than every call. Because it is configured through a base URL, a team can trial it around an existing compatible harness instead of migrating its whole agent stack. The most immediate value is visibility in log-only mode: it can reveal the actual action distribution before a security policy becomes an enforced blocklist.

## Limits and uncertainty
The repository establishes the project’s architecture and stated behavior, not that it prevents all agent misuse. Its request-only rules rely on what appears in the conversation and may not capture every legitimate or malicious context. The supplied material gives an `atif-scan` latency estimate, but not end-to-end latency under production workloads, false-positive rates, bypass resistance, or results from independent security evaluation. The judge benchmark covers 562 scanner-flagged calls, which does not establish performance on clean calls or on threats that the scanner does not flag. Safeagents also operates at the tool-call boundary; it does not itself provide sandboxing, identity controls, least-privilege credentials, or network policy.

## Skill to build now
Run a compatible coding agent through safeagents in `--log-only` mode on a representative repository this week. Categorize the resulting calls into routine actions, unexpected destinations, sensitive reads, and scanner findings. Then write a short policy for which classes should be blocked and which need review. Only after measuring the false positives should the team remove log-only mode. This turns a generic desire for “agent safety” into an observable tool-call contract.

## Reader takeaway
Safeagents makes agent-tool control a deployable layer rather than a property of a particular model or coding harness. Its practical promise is simple: capture proposed actions before execution, learn from logs first, and enforce narrowly targeted blocks where the evidence supports them.

## Open question
Will teams find that its request-context rules and scanner signals are precise enough for blocking in normal coding workflows, or will they mainly remain a monitoring layer?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Claude Code](https://newruntime.com/topics/claude-code.md): Explore the claude-code topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)