OWASP Agent Memory Guard
https://owasp.org/www-project-agent-memory-guard/
Open-source runtime defense. Enforces YAML policies on every memory read/write. SHA-256 baselines detect tampering, injection, sensitive-data leakage, protected-key modification, rapid-change anomalies. Forensic snapshots + rollback. Reference impl for OWASP ASI06 (Memory Poisoning).
Active · Verified 2026-10-22 · fresh as of 2026-10-22 · 41 cited facts, 0 with a third-party source · 1 recorded change · Suggest a correction
At a glance
- Type
- Declarative YAML policies + SHA-256 baselines vendor fix
- Tier
- T3
- Created
- 2026-Q1 (OWASP project page set up Q1 2026; v0.2.1 with OWASP branding; v0.3.0 roadmap Q2 2026) vendor fix
- Latest release
- v0.3.1 (2026-08-25) repo fix
- License
- Apache-2.0 repo fix
- Pricing
- free / open source vendor fix
- Freshness
- 2026-10-22 fix
- Layer
- agent-infra repo fix
- Licensing
- open-source repo fix
Memory taxonomy
- storage
- file
- retrieval
- exact-match
- persistence
- long-term
- update
- read-only
- unit
- file
- governance
- auditable
- conflict
- n/a
When to use
Optimised for: governance + compliance + audit + adversarial hardening
Anti-fit: not for hobbyist / non-production use cases
Pros & cons
Pros
Standardized threat taxonomy for memory in agents — closest thing to industry consensus on memory threats.
Cons
Framework / taxonomy, not a tool; adoption depends on practitioner uptake.
Claims & capabilities
v0.3.0 roadmap (Q2 2026): LlamaIndex + CrewAI integrations, Redis + Postgres backends, Prometheus metrics.
Technical surface
- API surface
- not applicable — research paper
- Backend storage
- not applicable — research paper
- Deployment
- local deployment; Python; run against local memory stores
- Embedding model
- not applicable — research paper
- Multi-tenancy
- not applicable — research paper
- MCP
- not applicable — guidance / standard, not a product
- A2A
- not applicable — guidance / standard
- OpenTelemetry
- not applicable — guidance / standard
Alternatives to OWASP Agent Memory Guard → live options ranked by shared design, licence, hosting and MCP support
Similar systems
Other memory governance, privacy & safety in the catalog, ranked by inbound references.
- Lakera Guard / Lakera Red T1
Acquired by Check Point Software (completed by 2025-11-11); being folded into Check Point's AI security platform. Screens every prompt, response, and retrieved document for indirect prompt injection — primary vector for memory poisoning. Treats memory as untrusted: anything written to or read from memory is adversarial until proven clean. Lakera Red provides "Agent Breaker" gamified red-teaming.
- Acuvity (now Proofpoint) T1
Acquired by Proofpoint (closed 2026-02-12). Runtime enforcement targeting memory poisoning, unauthorised execution, identity spoofing per the OWASP LLM threat list. Visibility/control over MCP servers and locally-installed AI tools — the infrastructure layer where memory is most exposed.
- Enkrypt AI T1
Applies guardrails at three points: (1) before write to vector DB, (2) before query reaches embedding model, (3) before response. Detects malicious instructions in stored memory before retrieval; scans for PII/PHI in/out. Text + image + voice modalities. Acquired by Anaconda (2026-08-04); Enkrypt AI is now sold as Anaconda's AI security and guardrails product.
- HiddenLayer AISec Platform 2.0 T1
AI security platform with four modules: AI asset discovery, supply-chain/model integrity validation, continuous attack simulation, and runtime detection/response, including protection of agents and MCP-based systems.
- Hyperconsciousness (hc) T3
Developer-alpha encrypted, append-only knowledge store for humans and agents, with CLI/MCP access and scoped, expiring grants. Traction: Submitted via intake issue #181
- Mem0 Security / OpenMemory T1
Commercial Mem0 ships SOC 2 / HIPAA, zero-trust access controls, BYOK encryption, real-time monitoring, audit logs and workspace governance as defaults (Trust Center at trust.mem0.ai). For privacy-first deployments the self-hosted path is now the Mem0 open-source server (REST API + dashboard via Docker Compose with pgvector Postgres, admin setup wizard, per-user API keys, request audit log). As of Oct 2026 OpenMemory itself is a hosted MCP service and its old local Docker variant is no longer in the repo.
Sources (40 cited facts, 0 third-party)
Each fact links to the page it came from; the badge says who published it (how to read sources).
- What it is Declarative YAML policies + SHA-256 baselines vendor
- What it does & what's distinct Open-source runtime defense. Enforces YAML policies on every memory read/write. SHA-256 … vendor
- Claims / benefits v0.3.0 roadmap (Q2 2026): LlamaIndex + CrewAI integrations, Redis + Postgres backends, P… vendor
- Modalities text vendor
- Created 2026-Q1 (OWASP project page set up Q1 2026; v0.2.1 with OWASP branding; v0.3.0 roadmap Q… vendor
- Latest release v0.3.1 (2026-08-25) repo
- License Apache-2.0 repo
- GitHub OWASP/www-project-agent-memory-guard — ~185 stars, last commit 2026-08 repo
- Funding not applicable — OWASP Foundation open-source project; community-maintained vendor
- Customers / scale not applicable — open-source policy framework; not a commercial product vendor
- Pricing free / open source vendor
- Compliance provides compliance framework for OWASP ASI06 (Memory Poisoning); reference for EU AI Ac… vendor
- Deployment local deployment; Python; run against local memory stores vendor
- HQ not applicable — OWASP Foundation; global community vendor
- Founders / pedigree OWASP Foundation (open-source; community-maintained) vendor
- Memory volume / scale not applicable (policy framework; no memory storage) vendor
- Performance no public benchmark scores found — vendor does not publish quantitative perf metrics vendor
- Consistency strong vendor
- Versioning none vendor
- Schema evolution free-form / no schema vendor
- Namespace primitives hierarchical vendor
- Import / export Markdown / OWASP docs vendor
- Validated verticals regulated enterprise: financial-services, healthcare, government, legal vendor
- Time to running <1day to <1week (enterprise procurement + integration) vendor
- Anti-fit not for hobbyist / non-production use cases vendor
- Optimised for governance + compliance + audit + adversarial hardening vendor
- Adjacent infrastructure BYO agent stack; this layer guards it vendor
- Pros Standardized threat taxonomy for memory in agents — closest thing to industry consensus … vendor
- Cons Framework / taxonomy, not a tool; adoption depends on practitioner uptake. vendor
- Project & sources OWASP project vendor
- cost-input-usd-per-mtok 0 vendor
- cost-output-usd-per-mtok 0 vendor
- cost-tier free vendor
- cost-pricing-model free-tier vendor
- cost-last-verified 2026-06-29 vendor
- architecture-deployment-locus local vendor
- licensing-bucket open-source repo
- positioning-platform-vs-product platform vendor
- taxonomy-three-layer-rollup agent-infra repo
- sdk-languages python vendor
What changed
Changes to this record's lifecycle, licence, release, pricing and hosting facts, from the catalog's git history. Subscribe (Atom)