# Patronus Security

> Local-first prompt injection, PII and DLP checks for AI agents, with CLI scans and runtime protection.

- Type: Agent
- Author: patronus-protect
- License: Apache-2.0
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-10-13
- Source repository: https://github.com/patronus-protect/patronus-security-cli
- Repo state: not archived
- Last push: 2026-11-04T12:33:18Z
- Stars: 2 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 1
- Language: JavaScript
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Anthropic
- Domains: ai-security, data-security
- Tags: prompt-injection, ai-agent-security, mcp-security, pii, dlp, local-first
- Date added: 2026-10-12
- Listing page: https://exchange.tenable.com/agents/patronus-security
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/agents/patronus-security.md

Patronus Security is a Rust CLI for inspecting text used by AI agents. It combines explicit security scans with optional runtime integrations for OpenAI Codex, Anthropic Claude Code and DeepSeek Harness. Detection is powered by Patronus Ark.

## What it does

- Checks supported text for prompt injection, personally identifiable information and data loss prevention signals.
- Scans explicitly selected files, directories and repositories, with local extraction of UTF-8/UTF-16 text and text from PDF and DOCX documents.
- Provides runtime hooks for user-prompt text, tool-result text and MCP-result text in supported hosts. Completed dangerous findings remain behind receipts; verified redacted reads let the agent continue with masked content.
- Provides coverage and finding reports, runtime receipts and a loopback dashboard for reviewing activity and configuring protection.
- Supports explicit public URL and authenticated public MCP-server audits through the Patronus API.

## How it works

The CLI uses the configured Local, Hybrid or API processing mode. Local analysis of files and runtime text stays on the device. API mode sends scan text to `https://control.patronus.studio/api/v1/scan`. Hybrid keeps user prompts and files or tool/MCP results of at most 2,048 tokens local; larger files and results send every analysis chunk to that API. Repository scans make this decision per file. Explicit URL and MCP-server audits use the API in every processing mode. The [privacy documentation](https://github.com/patronus-protect/patronus-security-cli/blob/main/docs/privacy.md) describes these data flows and the optional document-upload path.

Runtime integrations inspect text before delivery to the model. They do not scan tool requests, envelope metadata or media bytes. If scanning infrastructure is unavailable, runtime protection preserves tool execution and identifies the content as unverified. Installation alone does not establish coverage: the project's [runtime text contract](https://github.com/patronus-protect/patronus-security-cli/blob/main/docs/runtime-text-contract.md) explains host verification and receipt limitations.

## Getting started

Follow the [installation runbook](https://github.com/patronus-protect/patronus-security-cli/blob/main/INSTALL.md), including its checksum-first installation option, on macOS or Linux. The release installer requires `curl` and a SHA-256 tool; prebuilt releases do not require Rust. Run onboarding to choose processing mode and supported host integrations:

```sh
patronus-security-scanner onboarding
patronus-security-scanner dashboard
```

Local protection requires no account. Authenticated cloud features require sign-in; anonymous public URL scans have a limited allowance. Local L3 analysis requires the corresponding Ark assets prepared during setup. Start a new agent chat after installing runtime integrations.

Patronus does not perform general SAST, dependency, CVE or malware analysis. Image-only PDFs require OCR and are reported as unsupported. Review findings and coverage in context; a clean scan does not establish that arbitrary software is safe. The CLI and first-party integrations use Apache-2.0; the engine and third-party assets have separate terms described in the [licensing notes](https://github.com/patronus-protect/patronus-security-cli/blob/main/docs/licensing.md).

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/agents/patronus-security.json. The full index and how to read it: https://exchange.tenable.com/llms.txt