Panguard AI Review (2026): Pricing, Features & Honest Verdict

Panguard AI is an open-source security platform for AI agents. It audits Claude Code and Cursor skills before they install, then intercepts risky actions at runtime against 768 detection rules. The free tier is complete and genuinely useful. The next tier up is $25,000. Best for: developers running agents with real system access. Price: from $0 (free plan: yes, MIT licensed). Rating: 7/10.

What is Panguard AI?

Panguard AI is a security layer for the thing almost nobody secured on the way in: the skills, plugins and MCP servers you hand to your coding agent. In 2026 a developer will install a Claude Code skill from a GitHub link with roughly the same care they once gave a browser extension, and that skill runs with the agent’s permissions, which increasingly means shell access, repository write access and whatever credentials happen to be in the environment. Panguard’s argument is that this is npm circa 2016 and the supply chain attacks have not properly started yet.

The product works in two layers. Before install, a Skill Auditor runs a six-check security gate over the code and scans it against ATR, or Agent Threat Rules, an open standard rulebook that currently holds 768 executable detection rules. At runtime an MCP proxy sits between the agent and its tools, intercepting actions and blocking the ones that violate policy. Detection is deterministic and local-first, and the output is signed, which matters if anyone is ever going to ask you to prove what happened.

The timing argument is worth taking seriously. Agent skills have every property that made package registries a favourite attack path: they are trivial to publish, discovered through informal channels like a Twitter link or a Discord message, installed by copy-paste, and almost never reviewed line by line before they run. What is different, and worse, is the blast radius. A malicious npm package runs in your build. A malicious agent skill runs with an assistant that has your shell, your repository and often your cloud credentials, and it can be triggered by text the agent reads from an untrusted web page rather than by anything you deliberately executed.

We found the credibility signal that made us take it seriously is upstream contribution rather than marketing. Panguard’s rules have been merged into Cisco AI Defense, 314 of them, and Microsoft AGT, another 287. Two large security vendors accepting your detection rules into their products is a harder thing to fake than a landing page.

What Are Panguard AI’s Key Features?

The Skill Auditor and the ATR rulebook

This is the part most people will use daily. Before a skill or MCP server loads, Panguard runs it through six checks and matches it against the ATR corpus. The rules are deterministic, meaning a given input produces a given verdict rather than an LLM’s opinion that varies by run. That is the correct design choice for a security gate. Panguard layers AI analysis on top for unknown threats, but the deterministic rules are the floor, and the floor is what you want to be predictable. The whole ATR set is open, so you can read exactly what is being checked instead of trusting a vendor’s threat feed.

Runtime interception via MCP proxy

Auditing before install catches malicious code. It does not catch a benign skill being talked into something stupid by a prompt injection buried in a web page the agent just read. Panguard’s proxy handles that case by evaluating actions as they happen and blocking ones that break policy. This is the harder half of the problem and the reason a pre-install scanner alone is not enough. It is also the part most likely to get in your way, because a runtime guard that blocks nothing is decorative and one that blocks too much makes the agent useless.

Auto-detection of your agent setup

Panguard detects Claude Code, Claude Desktop, Cursor and others automatically rather than making you configure each one. There is a CLI with 28 commands, a panguard-guard daemon for continuous monitoring, and a local dashboard. Nothing leaves your machine unless you choose to share it. For a security tool that is the right default, and it removes the obvious objection that installing a monitor means shipping your source code to a startup.

Shared threat intelligence

When Panguard detects something new, the pattern can be crystallised into a rule and pushed to everyone. Their documentation quotes roughly one hour from attack to distributed rule. The network effect here is real: a security rulebook gets better with more users in a way a dashboard does not. It is also the feature most dependent on Panguard reaching enough adoption to matter, which it has not yet.

How Much Does Panguard AI Cost?

The Community Edition is free forever, MIT licensed, self-hosted and unlimited. That is not a trial and not a crippled tier. You get the CLI, the guard daemon, the MCP proxy, the Skill Auditor and the full 768-rule ATR set. For an individual developer or a small team, the free version is the product.

Above that the pricing gets steep and specific. A Founding Pilot is a $25,000 one-time payment, aimed at enterprises that need documented security proof. Enterprise and above starts at $150,000 per year and adds sovereign deployment options and OEM licensing. Those tiers are priced for banks and regulated institutions that need evidence for the EU AI Act or NYDFS Part 500, and the signed audit output is the thing they are actually buying.

There is nothing in between, and the gap is the biggest problem with the commercial story. A 40-person startup that wants managed rule updates, a shared team policy and someone to call has no option except $25,000. Compare that to how the rest of developer security prices itself: Snyk starts around $25 per developer per month, Semgrep has a free tier and a paid tier in the low hundreds, GitGuardian is free up to 25 developers. Panguard has open source and enterprise and nothing resembling a team plan.

Who is Panguard AI Best For?

Use Panguard if you install third-party agent skills or MCP servers with any regularity. The Skill Auditor takes minutes to set up, costs nothing, and is the single highest-value thing you can do about a threat surface most developers have not thought about yet.

Use Panguard if you give your coding agent shell access or production credentials. The runtime proxy is the only part of your setup standing between a prompt injection and a destructive command.

Use Panguard if you work somewhere regulated and need to demonstrate agent governance. The signed, audit-ready evidence is built for exactly that conversation, and the EU AI Act framing is deliberate.

Skip Panguard if you only use first-party tooling with no third-party skills installed. Your exposure is genuinely low and the guard will mostly generate noise.

Skip the paid tiers unless you have a compliance requirement with a budget attached. At $25,000 the Founding Pilot is not a scaled-up version of the free tool, it is a procurement product. If nobody is asking you for evidence, the free edition is doing the same security work.

Best Panguard AI Alternatives

AgentGuard by GoPlusSecurity. The closest direct competitor and also open source. It blocks malicious skills, prevents data leaks and protects secrets, with 24 detection rules, runtime action evaluation and a trust registry. Far fewer rules than Panguard’s 768, but simpler to reason about. Free. Pick AgentGuard if you want something lighter with less to configure.

Guard Scanner. Another open-source option, with 364 patterns across 35 threat categories and 27 runtime checks, positioned as a zero-trust policy layer for MCP and A2A agents. Free. Pick it if policy enforcement across multiple agent protocols is your main concern rather than skill auditing.

Snyk or Semgrep. Not agent-specific, and that is the point. If your real worry is vulnerable dependencies and leaked secrets in code your agent writes, mature SAST tooling covers more ground and integrates with CI properly. Snyk starts around $25 per developer per month, Semgrep has a usable free tier. Pick these if you want general code security rather than agent-specific threat coverage.

Final Verdict: Is Panguard AI Worth It?

The free edition is worth installing this week if you run coding agents with third-party skills. It is MIT licensed, local-first, costs nothing, and addresses a threat surface that is expanding faster than anyone’s threat model. The 768-rule ATR corpus is substantial, the deterministic-first design is the right call, and the merged contributions to Cisco AI Defense and Microsoft AGT are real evidence that the rules hold up outside their own product. We would rather run this and find it quiet than skip it and find out the interesting way.

The commercial product is a different verdict. Jumping from $0 to $25,000 with nothing between them tells you Panguard has decided the middle of the market is not worth serving yet, and for a young project chasing regulated buyers that is a defensible bet. It just means most readers of this review will never be customers, only users. The rating reflects both halves: an excellent free tool with a thin, unproven commercial story and a rulebook whose network effects depend on adoption it has not earned yet. Install the community edition. Ignore the pricing page unless a compliance officer sent you.