Hugging Face's safeagents checks every tool call an AI agent makes before it runs. Its judge never sees the agent's reasoning

The safest place for an agent guardrail is somewhere the agent cannot talk its way past. Hugging Face just shipped a small tool built on that idea.

What happened

Hugging Face released safeagents, an open source proxy that sits between an agent and its model server. According to its README, it checks every tool call the model makes before the harness sees it. Blocked calls are swapped for a text notice, so nothing runs. It works with any harness that lets you set a base URL, such as Claude Code, Pi, Hermes and OpenCode, over OpenAI Chat Completions or Anthropic Messages.

Each call passes three stages. First, simple request checks: a call is blocked if it uses a tool the request never declared, or if its arguments contain a host that appears nowhere in the conversation. Second, the atif-scan detectors look for things like reading another process's environment or bypassing a proxy. Third, an optional judge model decides on calls marked suspicious.

The judge only sees what the user wrote, the tool call and the findings. It never sees the agent's reasoning or tool results, because an agent that wants a call to run would argue its case there. The judge can add blocks but never lift one. A log only mode reports what it would block, and the project ships a benchmark of 562 flagged tool calls for choosing a judge model.

My take

Most of us are not running coding agents on client servers, but the pattern carries straight into n8n, Make or Zapier agent builds:

1. Allowlist tools and destinations. If the agent suddenly wants to post to a domain nobody mentioned, stop it.
2. Keep the checker separate from the agent. Do not feed it the agent's explanation, only the request and the proposed action.
3. Start in log only mode. Run a week, read what would have been blocked, then turn blocking on.

Checks like these are plain code and cost almost nothing per call. The README puts atif-scan at about 10 to 20 ms per call on an M series Mac. That is cheap insurance next to an agent emailing the wrong list.