DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to test whether an agent can reach a payments API directly with Agent Safe Pipeline

Compare direct, shadow and enforced requests before any real traffic goes through a gateway.

Who it is forA platform engineer deciding whether an AI agent with a valid API credential should be allowed to call a consequential endpoint.

The problemA valid credential does not show that a specific request was authorized, and the target service accepts whatever arrives with a real credential.

The outcomeA table showing which adversarial requests reached the target directly, in shadow and under enforcement, with a verdict and an exit code.

What you need first

  • A terminal on macOS or Linux, with Homebrew, a Linux package, Docker or Helm available
  • An HTTP API or tool endpoint you want the gateway to sit in front of, or the local demo target on localhost:3000
  • Optional: a Decionis key from `agentsafe login`, if you want decisions from the Decionis control plane instead of the local demo authority

Steps

  1. Install AgentSafe with Homebrew: brew tap decionis/agent-safe https://github.com/decionis/agent-safe-pipeline && brew trust decionis/agent-safe && brew install agentsafe
  2. Run the boundary test: agentsafe test
  3. Read the Exposure line and the Verdict; exit code 0 means the boundary holds and 1 means exposure.
  4. Start the gateway in shadow mode against your API, using the next-step line the test prints: agentsafe proxy --upstream <your-api-url> --mode shadow (inferred, check the README)
  5. Compare what shadow mode would have held or refused with what the direct column reached.

Prompt for your agent

Using the decionis/agent-safe-pipeline repository, install AgentSafe and run `agentsafe test`. Report the Exposure line and the Verdict for the boundary test against <your-api-url> if you have one, otherwise against the built-in synthetic target. Confirm the exit code is 0 before you say the boundary holds.

Caveat. Without a Decionis key the test uses a local demo authority with a synthetic policy, so the result shows how the boundary behaves, not how your real policy would decide.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page