Best AI Agent Security Software for Pydantic AI
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
For one Pydantic AI agent that only reads data, the best security software is Pydantic AI itself plus the free Pydantic AI Harness guardrails: typed tools, requires_approval on anything that writes, and authorization checks inside each tool. You need a separate product when several agents or frameworks share the same tools, when approvals must come from someone other than the requester, or when an auditor wants a record of what each agent was allowed to do.
That is a short answer from a vendor, and it is the right one. Pydantic AI is carefully built, and its own documentation tells you where its responsibility ends. The question is only whether your agents have crossed that line yet.
Why Pydantic AI teams are shopping for security now
Pydantic AI 2.0 went stable on June 23, 2026, and Pydantic's version policy promises V1 security fixes "for at least 6 months after V2's stable release". That puts the guaranteed V1 window at roughly late December 2026, so most production teams are porting this quarter. The port is not only renames. V2 changed the default end strategy so that function tools can run alongside a final output where V1 often skipped them, rebuilt MCP wiring around MCPToolset, and renamed the deferred tool types your approval flow depends on.
Ten advisories also landed on the project's GitHub security page between June and September 2026. The most serious, GHSA-h4xc-3qfq-jf93, let a website a developer visited trigger agent runs through the local development chat UI. Another let a remote client get a server tool to run "with arguments it supplied rather than arguments the model produced". All were fixed quickly. Together they are the reason a security review lands on the backlog during the port. We go through each one on our Pydantic AI security page. This article is the buying half.
What Pydantic AI already gives you
Count what you own before you compare products. The primitives are good.
| Built-in control | What it does | Where it stops |
|---|---|---|
| Typed tools and validation | Arguments and outputs validated against Python types, with retries | Checks shape, not whether the call is allowed |
| Deferred tools | requires_approval and ApprovalRequired pause a run and return DeferredToolRequests | Opt-in, and "Approval is not an authorization boundary against an untrusted client" |
| RunContext and dependencies | Carries user identity and services into each tool | You still write the permission check in every tool |
| Harness guardrails | Input, output and tool guardrails, with detectors for secrets, personal data and keywords | Pydantic: a regex "does not find a prompt injection, which is ordinary language" |
| web_fetch protections | SSRF blocking and allowed or blocked domain lists | Four bypasses fixed in September 2026 releases 2.44.0 and 1.107.6 |
| OpenTelemetry instrumentation | Spans for runs, model calls and tools | A trace of what happened, not a verdict on whether it should have |
The line that matters most is the approval warning. If your agent is served to a browser through a UI adapter, the client that makes the request is the same one that sends back approvals. Pydantic's guidance is to enforce real authorization inside the tool function. That is correct, and it means every tool author on every team has to get it right, every time.
The six options, compared honestly
These are the realistic choices for a US team running Pydantic AI agents in production. Two cost nothing in license fees, and in the right situation we would pick them before ourselves.
| Option | What it is | Best for | Main tradeoff |
|---|---|---|---|
| Pydantic AI plus Harness | The framework's deferred tools, capabilities and official guardrails package | One team, a few agents, mostly read tools | Every rule lives in agent code, and detectors cannot catch injection in plain language |
| Community pydantic-ai-guardrails package | Open-source capabilities such as DetectPromptInjection, DetectPII and LimitCost for Pydantic AI 2.x | Teams that want injection screening without building it | Community maintained, so you own the upgrade and support risk |
| Logfire AI Gateway | Pydantic's own gateway for model calls, with spending caps, failover and scanning of prompts and completions for personal data and secrets | Controlling model spend and keeping sensitive data out of provider calls | Sits on the model call, not on the tool calls your agent makes to your systems |
| An authorization service called from tools | A fine-grained authorization provider your tool code queries before acting | Teams that already run centralized authorization for their app | Only as good as the tools that remember to call it |
| Microsoft Agent Governance Toolkit | MIT licensed policy engine that lists PydanticAI among its integrations | Engineering-led teams that want one open-source policy layer across frameworks | Self-hosted only, so you run and patch a component in the path of every action |
| A managed control plane such as AgentShield | A gateway outside the agent process for tool permissions, approvals, injection screening and audit | Several agents or frameworks, approvals that a client cannot grant itself, audit evidence | A paid product and one more service in the request path |
If the open-source policy route appeals, our comparison of Agent Governance Toolkit alternatives covers the build-versus-buy math in more depth. The short version is that the toolkit is good and free, and the real cost is the on-call rotation for something every agent action passes through.
How to choose AI agent security software for Pydantic AI
Three questions sort almost every team.
Can any of your agents change something that matters? Refunds, account changes, outbound email, database writes, anything that moves money. If no agent can, Pydantic AI plus Harness is enough, and buying a control plane is cost without a matching risk. If yes, the next question decides the rest.
Who approves the risky calls? If your approvals come back from the same client that asked, you do not have approval, you have a confirmation dialog. You need either a back-office approval flow you build and maintain, or a hold enforced outside the agent that routes to a named person. Our human approval for AI agents page shows how the second option works in practice.
How many places do your rules live? A single Pydantic AI service can keep its policy in code. Three services, a LangChain agent from another team and an OpenAI Agents SDK prototype cannot, because the rules drift apart within a quarter. That is when a single policy point pays for itself. Before you decide, find every place a tool is defined. On a large codebase, a semantic code search across your repositories for tool decorators and MCPToolset calls is a faster inventory than asking each team.
| Your situation | What we would use |
|---|---|
| One internal agent, read-only tools | Pydantic AI plus Harness. Buy nothing |
| One customer-facing agent with a few write tools | Harness, requires_approval, back-office approvals and authorization inside each tool |
| Model spend and data leaving to LLM providers is the main worry | Logfire AI Gateway on the model path |
| Several agents or frameworks sharing tools, or an audit coming | A managed control plane on the tool path, with Harness kept in place |
What to test during the V1 to V2 port, whatever you buy
The port is the cheapest moment to add controls, because every agent is already open on someone's screen.
- Tools with side effects under the new end strategy. Build a test where the model returns a final output and a write tool call together. Under V1 that tool often did not run. Under V2 it does.
- Every approval path. After renaming DeferredToolCalls to DeferredToolRequests, confirm each approval-marked tool still pauses, and that a denial really blocks.
- MCP allowlists. Rebuilding per-transport servers as MCPToolset is where a filtered tool list quietly becomes the full list.
- Alerts on held and denied calls. In instrumentation version 5, deferred calls are no longer recorded as span errors, so any alert built on error spans may have gone quiet.
- Upgrade past the advisories. At minimum 2.44.0 on V2 or 1.107.6 on V1, and stop exposing the development chat UI outside localhost.
Where AgentShield fits, and where it does not
AgentShield sits on the outbound path. You point your MCPToolset servers at our MCP gateway and your HTTP tools at our proxy. Each call is checked against a per-tool policy, calls above a threshold are held for a named approver, fetched pages and retrieved documents are screened for injected instructions, and every decision is written with requester, tool, validated arguments and verdict. The rules live in one place, described on our AI agent permissions management page, and they apply the same way to Pydantic AI, LangChain and OpenAI agents calling the same tools.
It does not replace Pydantic validation, which you should keep. It does not see pure in-process functions that never leave your service. And it is not the right purchase for a single read-only agent, where the free options above do the job.
If you are porting to V2 this quarter and your agents can write, the useful next step is to run one agent through the gateway in staging and look at what it actually calls. Most teams find at least one tool they did not know was exposed.
See the firewall block an attack live.
Drive the Threat Console and watch a real prompt injection get stopped, then put AgentShield in front of your own agents.