Microsoft Agent Governance Toolkit
https://github.com/microsoft/agent-governance-toolkit
Cross-Model Verification Kernel (CMVK) requires majority-voting agreement across multiple model calls before a memory-influenced action. Agent OS package intercepts every action (memory included) at sub-millisecond latency. MIT licensed.
Active · Verified 2026-10-22 · fresh as of 2026-10-22 · 54 cited facts, 1 with a third-party source · 1 recorded change · Suggest a correction
At a glance
- Tier
- T2
- Latest release
- v4.1.0 (2026-06-11) registry fix
- GitHub
- microsoft/agent-governance-toolkit — ~6.1k stars repo fix
- Pricing
- free / open source (MIT) repo fix
- Freshness
- 2026-10-22 fix
- Layer
- agent-infra repo fix
- Licensing
- open-source repo fix
- SDK languages
- csharp, python, rust, typescript repo fix
- Developer activity
- OpenRank 17.73 (12-mo avg 16.36) · 86 participants — 2026-09 third-party fix
Memory taxonomy
- storage
- append-only
- retrieval
- agentic
- persistence
- session
- update
- read-only
- unit
- policy
- governance
- auditable
- conflict
- llm-arbitrate
When to use
Optimised for: governance + compliance + audit + adversarial hardening
Anti-fit: not for hobbyist / non-production use cases
Pros & cons
Pros
Microsoft's governance toolkit for AI agents — covers memory access policies + audit trails as part of broader agent governance.
Cons
Microsoft-stack-tilted; less applicable outside M365 / Azure deployments.
Claims & capabilities
p99 < 0.1ms. Integrations for LangChain, CrewAI, Google ADK, Microsoft Agent Framework. Python / TypeScript / Rust / Go / .NET. April 2026.
Technical surface
- API surface
- REST, PowerShell
- Backend storage
- custom (Microsoft 365)
- Deployment
- library/SDK integration; multi-language (Python TypeScript Rust Go .NET); LangChain/CrewAI/Google ADK integrations
- Embedding model
- not applicable — governance tool
- Multi-tenancy
- hard-isolation
- MCP
- Yes — MCP Security Scanner (tool poisoning, typosquatting, hidden instructions); A2A/MCP Protocol Bridge in Agent Mesh
- A2A
- Yes — Agent Mesh provides A2A/MCP/IATP protocol bridges (per agentmesh-platform docs); zero-trust identity + trust scoring
- OpenTelemetry
- Yes — Telemetry package provides OpenTelemetry integration (per PACKAGE-FEATURE-MATRIX.md)
Alternatives to Microsoft Agent Governance Toolkit → live options ranked by shared design, licence, hosting and MCP support
Similar systems
Other memory governance, privacy & safety in the catalog, ranked by inbound references.
- Lakera Guard / Lakera Red T1
Acquired by Check Point Software (completed by 2025-11-11); being folded into Check Point's AI security platform. Screens every prompt, response, and retrieved document for indirect prompt injection — primary vector for memory poisoning. Treats memory as untrusted: anything written to or read from memory is adversarial until proven clean. Lakera Red provides "Agent Breaker" gamified red-teaming.
- Acuvity (now Proofpoint) T1
Acquired by Proofpoint (closed 2026-02-12). Runtime enforcement targeting memory poisoning, unauthorised execution, identity spoofing per the OWASP LLM threat list. Visibility/control over MCP servers and locally-installed AI tools — the infrastructure layer where memory is most exposed.
- Enkrypt AI T1
Applies guardrails at three points: (1) before write to vector DB, (2) before query reaches embedding model, (3) before response. Detects malicious instructions in stored memory before retrieval; scans for PII/PHI in/out. Text + image + voice modalities. Acquired by Anaconda (2026-08-04); Enkrypt AI is now sold as Anaconda's AI security and guardrails product.
- HiddenLayer AISec Platform 2.0 T1
AI security platform with four modules: AI asset discovery, supply-chain/model integrity validation, continuous attack simulation, and runtime detection/response, including protection of agents and MCP-based systems.
- Hyperconsciousness (hc) T3
Developer-alpha encrypted, append-only knowledge store for humans and agents, with CLI/MCP access and scoped, expiring grants. Traction: Submitted via intake issue #181
- Mem0 Security / OpenMemory T1
Commercial Mem0 ships SOC 2 / HIPAA, zero-trust access controls, BYOK encryption, real-time monitoring, audit logs and workspace governance as defaults (Trust Center at trust.mem0.ai). For privacy-first deployments the self-hosted path is now the Mem0 open-source server (REST API + dashboard via Docker Compose with pgvector Postgres, admin setup wizard, per-user API keys, request audit log). As of Oct 2026 OpenMemory itself is a hosted MCP service and its old local Docker variant is no longer in the repo.
Sources (53 cited facts, 1 third-party)
Each fact links to the page it came from; the badge says who published it (how to read sources).
- What it is Cross-Model Verification Kernel + Agent OS repo
- What it does & what's distinct Cross-Model Verification Kernel (CMVK) requires majority-voting agreement across multipl… repo
- Claims / benefits p99 < 0.1ms. Integrations for LangChain, CrewAI, Google ADK, Microsoft Agent Framework. … repo
- Modalities text repo
- Created 2026-03 repo
- Latest release v4.1.0 (2026-06-11) registry
- License MIT repo
- GitHub microsoft/agent-governance-toolkit — ~6.1k stars repo
- Mindshare 1.4k GitHub stars (+50/mo); growing signal for enterprise governance tooling repo
- Funding not applicable — Microsoft Research; no external funding repo
- Pricing free / open source (MIT) repo
- Compliance MIT-licensed tooling; Microsoft Azure enterprise compliance stack available separately repo
- Data handling local enforcement (sub-millisecond p99 action interception); no mandatory cloud dependency repo
- Deployment library/SDK integration; multi-language (Python TypeScript Rust Go .NET); LangChain/Crew… repo
- HQ not applicable — Microsoft Corporation (Redmond WA) repo
- Founders / pedigree Microsoft Research repo
- Memory volume / scale internal — undisclosed (enterprise toolkit) repo
- Performance no public benchmark scores found — vendor does not publish quantitative perf metrics repo
- API surface REST, PowerShell vendor
- Backend storage custom (Microsoft 365) vendor
- Multi-tenancy hard-isolation vendor
- Encryption at-rest + in-transit vendor
- SSO / RBAC SSO + RBAC vendor
- Consistency not specified — vendor docs do not address this dimension repo
- Versioning none repo
- Schema evolution not specified — vendor docs do not address this dimension repo
- Namespace primitives not specified — vendor docs do not address this dimension repo
- Contradiction handling LLM resolves and overwrites repo
- MCP support Yes — MCP Security Scanner (tool poisoning, typosquatting, hidden instructions); A2A/MCP… repo
- A2A support Yes — Agent Mesh provides A2A/MCP/IATP protocol bridges (per agentmesh-platform docs); z… repo
- OTel Yes — Telemetry package provides OpenTelemetry integration (per PACKAGE-FEATURE-MATRIX.md) repo
- Import / export Yes — JSON export/import via AuditLogger (hash-chained audit events); identity.go suppor… repo
- Validated verticals regulated enterprise: financial-services, healthcare, government, legal repo
- Time to running <1day to <1week (enterprise procurement + integration) repo
- Anti-fit not for hobbyist / non-production use cases repo
- Optimised for governance + compliance + audit + adversarial hardening repo
- Adjacent infrastructure BYO agent stack; this layer guards it repo
- Pros Microsoft's governance toolkit for AI agents — covers memory access policies + audit tra… repo
- Cons Microsoft-stack-tilted; less applicable outside M365 / Azure deployments. repo
- Project & sources GitHub microsoft/agent-governance-toolkit repo
- commit-trajectory [{"ym":"2026-04","cum":967},{"ym":"2026-05","cum":1490}] repo
- cost-input-usd-per-mtok 0 repo
- cost-output-usd-per-mtok 0 repo
- cost-tier free repo
- cost-pricing-model free-tier repo
- cost-last-verified 2026-06-29 repo
- architecture-deployment-locus local repo
- licensing-bucket open-source repo
- positioning-platform-vs-product platform repo
- taxonomy-three-layer-rollup agent-infra repo
- developer-activity-opendigger {"activity":295.91,"as_of":"2026-09","openrank_12mo":16.36,"openrank_current":17.73,"par… third-party
- sdk-languages csharp,python,rust,typescript repo
- maturity preview repo
What changed
Changes to this record's lifecycle, licence, release, pricing and hosting facts, from the catalog's git history. Subscribe (Atom)