AI Coding Agent Security Tools Ranked: Shoofly, ClawMoat, Armorer, AgentPort, Lakera, and the DIY Path

You are here because your engineers are running Claude Code, Cursor, Codex, or OpenClaw with their real laptop credentials — and somewhere in the last year the risk stopped being theoretical. CVE-2025-59536 proved a cloned repo could achieve code execution in Claude Code before the trust dialog appeared. CVE-2026-21852 proved a settings file could redirect ANTHROPIC_BASE_URL to an attacker endpoint and leak API keys on project open. CVE-2026-25253 proved any website could hijack an OpenClaw gateway over its localhost WebSocket. Your security team noticed, and now there is budget for an "agent security tool" and a pile of very young vendors happy to take it.

This page is the buyer's map: what layer of the stack each product actually protects, what it costs as of October 2026, where the detection gaps are (we ran the free tier of one of them against seven live attack phrasings — the misses are more instructive than the hits), and when you should build nothing and wire the free hooks that ship with the agent itself.

Every fact below was verified against vendor pages, GitHub APIs, npm registry data, or NVD records on 2026-10-15. Prices change; treat every number as a snapshot and re-verify before you sign anything.

The 30-Second Version

What Changed Since You Last Looked

The "agent security" category did not exist as a budget line two years ago. Three things made it one:

1. The exploit chains went from theoretical to CVE-numbered. The Claude Code config-file chain is the canonical example. A malicious repository ships a crafted .claude/settings.json or .mcp.json; the tool loads it automatically on project open; the config auto-approves MCP tool calls or redirects API traffic. NVD's entry for CVE-2025-59536 describes versions before 1.0.111 executing code contained in a project "before the user accepted the trust dialog." Its successor, CVE-2026-21852 (GHSA-jh7p-qr78-84p7, fixed in 2.0.65), covers a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and makes the client issue API requests — potentially leaking keys — before the trust prompt renders. The pattern is structural: repo-controlled config is code execution until the tool proves otherwise.

2. Agents got real host access, en masse. OpenClaw — the open-source assistant that sends emails, runs shell commands, and manages calendars from your machine — sits at 392k stars on GitHub as of October 15, 2026, with commits landing daily. Its own CVE-2026-25253 (any website can brute-force the localhost WebSocket gateway and take over the agent, fixed in 2026.1.29) and Ollama's ollama launch openclaw one-liner turned "agent on my main machine with my credentials" into a default deployment shape for hundreds of thousands of developers.

3. The frameworks published enough for buyers to compare. OWASP's Agentic Security Initiative and its LLM Top 10 (2026 revision) gave this category shared vocabulary, and Microsoft's agentic AI security guidance explicitly recommends constraining agent-initiated actions without explicit approval — which is a purchase requirement written in policy language.

What has NOT happened: none of these products have meaningful independent security research behind them. Everything you will read below — including our own test results — is vendor claims plus hands-on smoke testing. If a vendor tells you their product "blocks prompt injection," ask for their detection-rate methodology. None of the six publish one.

The Framework Most Buyers Get Wrong: Four Layers, Four Different Products

"AI coding agent security" conflates four distinct control layers, and vendors deliberately blur them. Before you compare products, decide which layer you are actually buying for — the failure modes are different, and a product that is excellent at one layer is usually absent at the others.

        ┌────────────────────────────────────────────────────────────┐
        │  LAYER 1: INPUT — text entering the model                  │
        │  Stops: injected instructions reaching the LLM             │
        │  Products: Lakera Guard, Meta PromptGuard (LlamaFirewall)  │
        │  Blind spot: injection that enters via tool OUTPUT or      │
        │  repo files (CLAUDE.md, settings.json) — already "inside"  │
        └────────────────────────────────────────────────────────────┘
                                       │
        ┌────────────────────────────────────────────────────────────┐
        │  LAYER 2: ACTION — the tool call the agent is about to fire│
        │  Stops: the curl, the write to ~/.ssh, the 400th loop call │
        │  Products: Shoofly Advanced, ClawMoat Pro, Claude Code     │
        │  PreToolUse hooks (DIY)                                    │
        │  Blind spot: policy gaps — a rule that does not match the  │
        │  attack is not a control                                   │
        └────────────────────────────────────────────────────────────┘
                                       │
        ┌────────────────────────────────────────────────────────────┐
        │  LAYER 3: INTEGRATIONS — third-party APIs the agent calls  │
        │  Stops: destructive ops (refunds, deletes) + key custody   │
        │  Products: AgentPort (approval gates, keys never exposed)  │
        │  Blind spot: your own shell and filesystem — not its lane  │
        └────────────────────────────────────────────────────────────┘
                                       │
        ┌────────────────────────────────────────────────────────────┐
        │  LAYER 4: THE PIPELINE — finding + fixing + proving        │
        │  Stops: nothing at runtime; removes entire attack classes  │
        │  Products: Armorer Labs (red-team, fix PR, Guard rule),    │
        │  enterprise red-teaming (Lakera service)                   │
        │  Blind spot: coverage between assessments                  │
        └────────────────────────────────────────────────────────────┘

The layers compose; they do not substitute. A team that buys an input-layer firewall (Lakera) and assumes its laptops are protected from a malicious repo config has bought the wrong layer. A team that buys Shoofly and assumes its Stripe refunds are safe has bought the wrong layer too. Most small teams should start at Layer 2 — it is the cheapest place where "blocked" is a real outcome — and that is where most of the young vendors live.

The Comparison Table

Shoofly: The $5 Interception Layer, From a Very Small Vendor

Shoofly intercepts tool calls at the decision gate — between the agent's output parser and the tool executor — for Claude Code (including Cowork and Dispatch) and OpenClaw. The architecture is documented better than most: a shoofly-check hook rides Claude Code's native PreToolUse hook (exit 0 = allow, exit 1 = block with a JSON reason), and a local daemon keeps an in-memory ring buffer of the last 500 tool calls for frequency and sequence analysis — loop detection, call floods, read-write cycles. Rules are deterministic (regex, path prefix, frequency threshold — no LLM in the gate), the threat policy is a readable YAML file, and evaluation is 100% local with sub-20ms claimed overhead. The tier split is honest: Basic (free) detects and alerts but never blocks; Advanced ($5/month) is the interception layer.

Why a team picks it: it is the cheapest product that turns "blocked" into a real runtime outcome for exactly the agents your engineers actually run, and the open policy YAML means your security team can read and extend every rule instead of trusting a black box. The 20 shipped rules span five categories — prompt injection (8), tool-response injection (2), out-of-scope writes (3), runaway loops (4), data exfiltration (4).

Honest weaknesses: the vendor's own architecture post admits the gate fails open — "if the gate crashes, the tool call proceeds." A security control that degrades to allow-on-error is a real design decision (they argue fail-closed gets uninstalled), but you should know your guardrail disappears exactly when its own code has a bug. The rule engine is regex- and path-based, so it inherits the same paraphrase blindness we measured in ClawMoat below — a novel exfiltration phrasing that matches no rule passes. And the traction numbers are candid: the public repo sits at 2 stars and its Show HN drew 3 points. This is a product you buy knowing you are an early adopter of a very small company's core asset.

Pricing (as of 2026-10-15 — verify at shoofly.dev): Basic free forever; Advanced $5/month per the vendor's own README. Ten developers on Advanced is $50/month — the cheapest real enforcement tier in this comparison.

Who should pick it: a team standardized on Claude Code and/or OpenClaw that wants pre-execution blocking this week, can read YAML, and accepts single-vendor early-stage risk. If "the security vendor must have 500 customers" is a procurement requirement, skip to Armorer or Lakera.

ClawMoat: Best Self-Serve Packaging, With Measured Blind Spots

ClawMoat is runtime containment for desktop agents — Claude Code, Cursor, Codex, Copilot, Windsurf, and MCP-heavy setups — with the clearest go-to-market in the category: a free open-source scanner as the trust builder (it publishes an agent-review prompt so your own coding agent can audit the product before you buy it — genuinely unusual and worth credit), then Pro and Team tiers for enforcement and audit artifacts. The package is MIT, v1.0.0 on npm, and has zero runtime dependencies — we verified the tarball: the dependencies field is null. The scanner surface is broad: prompt-injection, secrets, jailbreak, exfiltration, dependency-attack, supply-chain, excessive-agency, PII, memory-poisoning, boundary, and obfuscation modules, plus SARIF/JSON output for CI wiring.

We ran the free scanner ourselves (v1.0.0, this host, October 15, 2026) against seven attack phrasings. Results:

That is a fair sample of the whole category's weak point: keyword-shaped attacks get caught, paraphrased and structural attacks pass. Treat the free scanner as a tripwire, not a wall — the paid runtime-enforcement tier is the actual control.

One sharp edge we found in source, relevant if you wire it into CI: the wiki documents exit codes 0 (clean) and 1 (threats detected), but the actual code (bin/clawmoat.js, scan path) returns exit 2 for critical findings and exit 1 for lesser findings. If your pipeline only checks for exit 1, criticals will look like success-or-noise depending on how you test. Verify against the version you pin.

Why a team picks it: the only vendor in the set with self-serve team packaging — shared policy templates, CI-ready scan workflow, audit evidence exports, 48-hour email support — at a price a manager can expense without procurement.

Honest weaknesses: tiny vendor (43 GitHub stars, Show HNs at 2-3 points), Pro is strictly single-user, Team caps at 10 seats, and the vendor is explicit that support excludes custom implementation, penetration testing, and compliance certification — do not buy it expecting an enterprise engagement. The Agency tier is self-described as "intentionally not pushed yet."

Pricing (as of 2026-10-15 — verify at clawmoat.com/pricing): Scanner free; Pro $14.99/month or $149/year (annual saves $30.88 — 17%); Team $49/month or $499/year for up to 10 seats ($4.90/seat/month; annual saves $89). A 10-seat team pays the same $49 as Shoofly's 10×$5 — but gets shared policy templates and audit exports instead of per-seat enforcement instances.

Who should pick it: a 3-10 person team that wants enforced runtime policy plus CI gates and audit receipts this week, without a sales call. Not for orgs needing more than 10 seats, an SLA, or anyone to call during an incident.

Armorer Labs: The Red-Team-Fix-Enforce Pipeline (Quote Required)

Armorer Labs is the only product here that treats agent security as a pipeline rather than a point tool: Assess (access-maps what your agent can be made to do, reproduces the attack), Fix (writes a draft pull request with the control), Protect (Armorer Guard enforces the fix at runtime). The demo flow on their site shows a support agent steered by a web page into exporting customer records — mapped to OWASP Agentic 2026 (ASI01, ASI02), OWASP LLM 2026 (LLM01-03), MITRE ATLAS v2026.09 (AML.T0051.001, AML.T0086), and NIST AI RMF 1.0 MEASURE 2.7 — reproduced 25/25, then blocked by a Guard rule shipped as a runtime policy JSON with an immutable "effect": "deny". The founders are credentialed (three years building AI security systems at AWS; the CEO led AWS's first customer-facing AI security agent; both are Black Hat USA 2026 speakers), the company is Y Combinator-backed, and they maintain a public threat-intel feed (29 entries as of late September 2026) including practical controls like applying Microsoft's Secure Now agentic containment pattern.

Why a team picks it: the "verify the fix" step is the thing nobody else does. Every other product on this page gives you tools to prevent attacks; Armorer claims to demonstrate the attack, demonstrate the block, and hand your engineers the diff. For a security team that needs evidence for an audit trail — not just a dashboard — that workflow maps directly onto what an assessor asks for.

Honest weaknesses: no public pricing, no self-serve tier, and no public customer references on the site — every evaluation starts with "book a meeting." The public GitHub surface is SDKs and integration contracts (Armorer-Guard, 44 stars), not the product itself, so you cannot audit the enforcement engine the way you can with Shoofly's YAML or ClawMoat's MIT scanner. And it is the youngest company on the page; the YC badge is a stage, not a track record.

Pricing: quote-only. Expect an enterprise-style conversation; bring your agent inventory.

Who should pick it: a security team that needs to justify agent rollout to an audit or risk committee, wants attacks reproduced and fixes proven before signing, and has the budget cycle for a sales-process vendor. Skip if you need something self-serve this afternoon.

AgentPort: Key Custody and Approval Gates, Not Laptop Security

AgentPort is an open-source (MIT) gateway that sits between your agent and third-party services — Stripe, GitHub, Gmail, Linear, PostHog, and ~50 others via MCP or a CLI. Its two security primitives are clean: agents never see the API keys (the gateway holds them), and every tool call carries a per-tool policy — auto-approve, ask-for-approval, or deny. The approval flow is the best-designed detail in the category: the human approves the exact tool and the exact parameters (a refund for customer 1234 at $15 cannot be replayed for $500), the agent's own tokens cannot approve requests, TOTP 2FA is optional on the approval screen, approvals expire after 10 minutes by default, and everything is logged with both requester and approver IPs. Default posture is deny-until-configured. It self-hosts with docker compose.

Why a team picks it: if your agents call SaaS APIs that can move money or delete data, this is the correct layer — it converts "the agent has my Stripe key" into "the agent can request refunds, which a human approves with 2FA." Nothing else on this page does that.

Honest weaknesses: it protects the integrations surface, not the host. A malicious repo config that shells out on your laptop is invisible to AgentPort — that is Shoofly/ClawMoat/hooks territory. Traction is small (29 stars) and the public repo's last push was June 2026, though the docs are active. The marketing site root 404'd at the time of writing — the docs and the app subdomain are the live surfaces, which tells you where the team's effort is going. The enterprise motion ("production guardrails at your company") is an email address, not a product page.

Pricing (as of 2026-10-15): the open-source gateway is free; the cloud instance is free for individual use per the docs; enterprise deployment is unpriced — contact the team.

Who should pick it: teams whose highest-risk agent surface is third-party APIs — support agents issuing refunds, ops agents touching production SaaS. Pair it with a Layer 2 tool; do not substitute it for one.

Lakera Guard: The Enterprise Platform (For Someone Else's Problem)

Lakera is the most established security vendor in this comparison — an AI-native platform spanning workforce AI security, AI agent security (runtime protection, prompt-injection prevention, data-leak prevention), GenAI gateway security, and an expert-led red-teaming service, with claims of sub-50ms runtime latency and detection informed by a large security-researcher community. If your organization is deploying customer-facing LLM applications and agents at enterprise scale, Lakera (or its peers at that tier — Cisco AI Defense, Microsoft's Entra/Defender agent stack) is a serious shortlist candidate.

Honest weaknesses, for this specific buyer: Lakera is built for the platform security team securing AI applications — gateway-attached, API-first, app-layer. The coding agents your engineers run on their laptops are a different deployment shape: repo-borne config attacks (CVE-2025-59536-class) and shell-level exfiltration are not what a prompt-input firewall is positioned to stop, and retrofitting an enterprise AI platform to cover developer laptops is the most expensive possible route to coverage you can get for $5/month from Shoofly. There is no public pricing; evaluation is a sales process.

Who should pick it: orgs with a broad AI-security mandate (customer-facing chatbots, RAG, internal agents behind a gateway) where coding agents are one surface among many — buy it for the platform, add hooks for the laptops. Skip it if the only thing you are securing is a dozen engineers running Claude Code.

The DIY Path: Free Hooks That Ship With the Agent, Plus LlamaFirewall

Before you spend anything: Claude Code ships a native hook system whose PreToolUse event can block any tool call before execution — the same mechanism Shoofly's Advanced tier rides. A minimal deny-list is a JSON file and a small script:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash|Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/deny-list.py"
          }
        ]
      }
    ]
  }
}

The hook script receives the tool name and arguments as JSON on stdin and returns exit 0 (allow) or a non-zero decision with a reason the agent sees. Your security team writes the deny rules — credential paths like ~/.ssh and ~/.aws, curl-to-unknown-hosts patterns, writes outside the workspace — and the agent enforces them with zero license cost. The official hooks reference documents the full event surface (SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop, and more).

For input-layer scanning, Meta's LlamaFirewall (inside the PurpleLlama project, 4.4k stars, active as of October 2026) provides three composable scanners — PromptGuard (prompt-injection and jailbreak classification for input and output), AlignmentCheck (monitors user-intent drift in multi-turn agent interactions), and CodeShield (static analysis of LLM-generated code, Semgrep- and regex-based). Meta states it runs in production internally. The research paper is public and worth reading before you build.

WEEK 1   Wire PreToolUse hooks for Bash|Write|Edit.   ~2-3 eng-days
         Deny-list: credential paths, workspace bounds.
WEEK 2   Add tool-output scanning (the injection path    ~2-4 eng-days
         that repo-config attacks actually use).
MONTHLY  Rule review as new attack patterns publish.      ~0.5 day/mo
         CVE watch for the agent tools themselves.       ~0.25 day/mo

Break-even math: at a loaded platform-engineer cost, one
engineer-week of DIY exceeds 8 years of Shoofly Advanced
for a 10-person team. The real costs are coverage gaps and
the person who leaves and takes the rulebook with them.

Know the licensing: PurpleLlama ships under the Llama 3.2 Community License, not MIT — fine for internal use, but read it before embedding in a product. The hook layer is yours. Shoofly's threat-policy YAML (MIT) and ClawMoat's scanner (MIT) are both forkable starting points for your own rules — arguably their best use to a team with any security engineering capacity.

Who should pick it: any team with a platform/security engineer to own it. Hooks give you the same enforcement point the $5-15/month products sell, with your rules instead of theirs. The products earn their fee when you have nobody to own the rulebook — that is the actual decision.

Worked Costs at Three Team Sizes (October 2026 List Prices)

The pricing tells the story plainly: the entire self-serve layer of this category costs less per month than one hour of contract security consulting. Whatever you choose, the bigger number in the equation is the engineering time to wire, adopt, and maintain it — a product nobody enables protects nobody.

Who Should Skip This Entire Category

Honesty requires the skip list, because not every reader has the problem these tools solve:

• Your agents only run in ephemeral, sandboxed CI. If Claude Code fires in a throwaway container with no credentials and network egress controls, the sandbox is the control — add capability-focused tooling only when agents start touching durable state. (We cover the sandbox-first economics separately in our agent sandbox cost guide.)
• You have not solved the basics. If API keys still live in ~/.bashrc and nobody rotates them, a $5 interceptor guarding a credential that is already three years stale is security theater. Fix secrets management first — that purchase order outranks this one.
• Your "agent exposure" is one engineer experimenting. Free tier everything: ClawMoat's scanner, Shoofly Basic, native hooks in alert-only mode. Spend when the deployment is real.
• You want a compliance checkbox. None of the self-serve tiers here certify anything. If the deliverable is "we passed the audit," that conversation starts at the Armorer/Lakera tier, and you should still verify their evidence formats against your actual assessor's requirements before signing.

The Bottom Line

If you are a small-to-mid team standardized on Claude Code or OpenClaw with real credentials on laptops, start with Shoofly Advanced ($5/mo) for interception or ClawMoat Team ($49/mo for 10 seats) if you need shared policy and audit artifacts — and wire the free native PreToolUse hooks regardless, because they are the same enforcement point and they survive any vendor's demise.

If your agents touch money-moving APIs, add AgentPort for key custody and human-approved parameters — it is the only layer here that makes "the agent issued a refund" an audited, two-factor'd, bounded event.

If you need evidence for a risk committee — attacks reproduced, fixes proven, controls mapped to OWASP Agentic 2026 and MITRE ATLAS — talk to Armorer Labs, and accept the sales cycle as the price of the pipeline. If your mandate is enterprise AI applications broadly, Lakera is the right tier; just do not buy it as laptop armor for coding agents.

And before any of it: update the agent tools themselves. Every exploit chain above is fixed in current versions — Claude Code 1.0.111+ then 2.0.65+, OpenClaw 2026.1.29+. The cheapest security control in this entire category is the version you already own.

Related reading: the authentication and authorization patterns that make key custody structural rather than bolted on in API Keys Were Never Going to Survive AI Agents; the integration-protocol layer in MCP in Production; one compliance-flight-recorder approach in the AIR Blackbox story; and a hands-on look at a vendor-shipped agent sandbox in Microsoft MXC execution containers.

Sources & Notes on Verification

Every pricing claim above was read from the vendor's own page on 2026-10-15; every star count and license field came from the GitHub API the same day; CVE descriptions came from NVD and the Anthropic advisory database, not from vendor marketing. The ClawMoat detection table reflects our own runs of the free scanner v1.0.0 on this host — it is a seven-sample smoke test of one product, not a benchmark of the category, and should be read as "free regex-based scanners have shape-dependent coverage," not "this product is bad." Vendor claims about detection rates, latencies, and blocked-attack counts are the vendors' own. Where a vendor publishes no pricing, this page says so rather than estimating.