Governance, audit, and discipline frameworks for AI coding agents — deterministic workflows, context budgets, tool gating, usage tracking.
Of the 30 agent governance tools here, the best one to start with is skills (rated SAFE by our security scan, ★ 265.8k). Skills for Real Engineers. Straight from my .claude directory.
Agent Governance Tools are AI-powered software designed to help developers and teams tackle agent governance-related tasks more efficiently. These tools are typically published as open-source projects on GitHub and can be integrated into existing workflows via MCP (Model Context Protocol), Claude Skills, or standalone agent frameworks. On Agent Skills Hub, we index 30 quality-scored Agent Governance Tools across languages including Shell, Python, Rust.
In 2026, the AI agent ecosystem is maturing rapidly. Agent Governance Tools can significantly boost development efficiency by automating repetitive tasks, reducing human error, and providing intelligent suggestions. The top 3 tools — skills, keep-codex-fast, agentseal — have earned an average of 10,371 GitHub stars, reflecting strong community validation. 21 of the listed tools come with clear open-source licenses, ensuring freedom to use and modify.
When choosing among Agent Governance Tools, consider these factors: 1) Community activity — GitHub stars and recent commit frequency indicate reliability; 2) Integration method — check if it supports MCP, Claude, or your preferred agent framework; 3) Language compatibility — the most common language in this list is Shell; 4) Quality score — Agent Skills Hub's composite score evaluates code quality, documentation completeness, and maintenance activity. Our recommendation: start with skills — it ranks highest in both star count and quality score.
A backup-first Codex skill for keeping local Codex state fast, clean, and recoverable.
Security toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection resistance, and audit live MCP servers for tool poisoning.
pip install agentseal # or: npm install agentseal
Curated, production-grade skills for AI coding agents. Battle-tested workflows for developers who use AI seriously.
npx skills add Mathews-Tom/armory
Intercept and inspect Coding Agent API traffic from Claude Code, Codex CLI, Gemini CLI, Cursor CLI, OpenCode, Kimi/Kimi Code, Pi, and Hermes in a local trace viewer.
uv tool install claude-tap
AI agents are getting tool access — shell, file system, databases, APIs, secrets. But **nobody is governing what they actually do with it**. Frameworks like LangChain, CrewAI, AutoGen, and Claude Code give agents the power to execute. Agent Armor gives you the power to control, audit, and approve every single action before it happens.
cargo install --path crates/iaga-sentinel-core
Constitution-first AI orchestration: one Charter (YAML) defines mission, budget & rules. CEO plans → CFO approves → Ledger tracks every cent & token → Auditor scores. 16 workers, Stripe, MCP. Think. Audit. Execute.
git clone https://github.com/Justin0504/Sovereign-OS.git && cd Sovereign-OS
Pi coding-agent extension for pruning tool-call trees
git clone https://github.com/championswimmer/pi-context-prune
Claude Code usage governor: compact professional output, context slimming, tool-output filtering, telemetry, and drift guardrails.
bash install.sh --force🛩️ Git-native workflow control for coding agents: approved plans, verification, and reviewable evidence for Claude Code, Codex, Cursor, and Aider.
npm i -g agentplane
TDD enforcement and guardrails for Claude Code, Codex, and GitHub Copilot CLI
npm install -D @nizos/probity
One command. 29 battle-tested security checks built into every AI coding assistant you already use without leaving your IDE.
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
pip install agent-governance-toolkit[full]
🛡️ A curated list of tools, frameworks, standards, and resources for AI agent governance, safety, and compliance
The curated list of tools, standards, and resources for governing AI agents in production: policy enforcement, audit trails, EU AI Act compliance, MCP and Claude Code security.
MCP server for AI agent for cybersecurity: automate assessment of documents, questionnaires & reports. Multi-format parsing, RAG knowledge base,Risks, compliance gaps, remediations.
git clone https://github.com/arthurpanhku/DocSentinel.git
CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 200+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.
Claude Skills for Governance, Risk, & Compliance (GRC): Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, EU AI Act, ISO 42001, ISO 27701, DORA, CSRD, India's DPDPA, CMMC 2.0, NIST AI Risk, SWIFT, CCPA/CPRA, and others. Benchmark 89% (with skills) vs 55% (without skills). Updated Monthly.
/plugin marketplace add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
AgentGuard：An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent
git clone https://github.com/WhitzardAgent/AgentGuard.git
EU AI Act compliance proxy for AI systems. Drop-in HTTP proxy that monitors every AI interaction for regulatory risks, logs to a tamper-proof audit trail, and generates legal-grade PDF reports. 143 rules across 8 Annex III domains. Self-hosted, open-core
git clone https://github.com/el1ght/aulite.git
sofagent is an open-source FDE Harness for AI coding agents — on entry, write your business judgment into files (workflows, ontology, AI nodes); after departure, audit every change against them. 28 codified audit rules, tamper-evident chain, snapshots, and an MCP toolset (104 tools, 12 plugins). Everything can be FDEing.
git clone https://github.com/KongFangXun/sofagent.git
Govrix Scout — AI Agent Governance Diagnostic Tool (OSS)
git clone https://github.com/manaspros/govrix-scout.git
✅ AI governance skill for Claude Code | AI 治理框架 | AI ガバナンスフレームワーク — Safety gates, evidence rules, anti-slack
git clone https://github.com/sstklen/yes.md.git ~/.claude/plugins/yes
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
git clone https://github.com/prowler-cloud/prowler
YAO = Yielding AI Outcomes. A rigorous engineering, evaluation, governance, and portability system for reusable agent skills.
Build tested agent skills and govern their lifecycle through a user-defined marketplace: evidence, discovery, updates, rollback, quarantine, and 17-platform distribution.
The Enterprise Architecture Governance Harness — strategy, architecture, delivery, and assurance using AI coding assistants
/plugin marketplace add tractorjuice/arc-kit
Decision audit trail + persistent memory for AI trading agents. Outcome-weighted recall, tamper-evident SHA-256 chain with RFC 3161 anchoring, 20 MCP tools.
pip install tradememory-protocol
Agent-ready DevOps, security, infrastructure, and compliance knowledge base with 80+ skills across Kubernetes, Terraform, AWS/Azure/GCP, AI platform operations, container hardening, SOC2/ISO27001, and incident response—plus ready-to-run scripts, templates, and playbooks for SRE, platform, and security teams.
npx skills add bagelhole/DevOps-Security-Agent-Skills
AI agent identity, signed credentials, delegated authority and portable governance evidence. Python core and offline verifier SDKs.
pip install --pre attestix
| Tool | Stars | Score |
|---|---|---|
| skills | ★ 265.8k | 82 |
| keep-codex-fast | ★ 1.6k | 61 |
| agentseal | ★ 383 | 56 |
| armory | ★ 339 | 62 |
| claude-tap | ★ 3.3k | 70 |
| IAGA-Sentinel | ★ 120 | 53 |
| Sovereign-OS | ★ 105 | 67 |
| pi-context-prune | ★ 254 | 67 |
| governor | ★ 133 | 77 |
| agentplane | ★ 87 | 62 |
| probity | ★ 243 | 64 |
| skill-file-security | ★ 71 | 70 |
| agent-governance-toolkit | ★ 6.5k | 73 |
| awesome-ai-governance | ★ 62 | 62 |
| awesome-ai-agent-governance | ★ 55 | 65 |
| DocSentinel | ★ 90 | 60 |
| ciso-assistant-community | ★ 4.6k | 71 |
| Claude-Skills-Governance-Risk-and-Compliance | ★ 946 | 66 |
| AgentGuard | ★ 150 | 57 |
| aulite | ★ 136 | 58 |
The top agent governance tools in 2026 are skills, keep-codex-fast, agentseal. Agent Skills Hub ranks 30 options by GitHub stars, quality score (6 dimensions including completeness, examples, and agent readiness), and recent activity. The list is rebuilt every 8 hours from live GitHub data.
skills (265.8k stars) is the most adopted choice for general agent governance workflows, written in Shell. keep-codex-fast (1.6k stars) is a strong alternative and uses Python instead. Pick by your existing stack: match the language and runtime your team already uses to minimize integration cost. If unsure, start with skills — it has the deepest community and the most examples online.
Avoid pre-built agent governance tools when (1) your use case requires deep customization that the tool's plugin system doesn't support, (2) you have strict compliance requirements that ban third-party dependencies, (3) the tool's maintenance is inactive (last commit >6 months ago), or (4) your data volume is small enough that a 50-line custom script is cheaper than learning the tool. For most production workflows above 100 requests/day, the time savings from a maintained tool outweigh the customization loss.
Agent Governance focuses specifically on governance, audit, and discipline frameworks for ai coding agents — deterministic workflows, context budgets, tool gating, usage tracking. AI Code Editors is a related but distinct category — see https://agentskillshub.top/best/ai-code-editor/ for those tools. The two often appear in the same agent pipeline but solve different problems: choose agent governance when your primary goal is the specific task, and ai code editors when the workflow is broader.
For most teams, yes. skills has 265.8k stars worth of community testing, handles edge cases you haven't thought of, and ships with documentation. Build your own only when (1) your requirements are deeply non-standard, (2) you have a security/compliance reason to avoid OSS dependencies, or (3) the maintenance burden is small enough (<200 lines of code) that you'll save time long-term. The break-even point is usually around 2-3 weeks of dev time saved.
Most agent governance tools listed are open source under permissive licenses (MIT, Apache 2.0). A handful offer paid managed/cloud versions on top of free self-hosted core. Always check the LICENSE file on each tool's GitHub repository before commercial use — some use AGPL or non-commercial restrictions that may not fit your deployment model.
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy: 42 published rules, covering credential harvesting, data exfiltration, curl | sh installers and more. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: