PUFFER
The autonomous immune system for AI agents
Like a puffer fish โ inflates when threatened, repels with spines, then deflates back to calm.
A local-first security daemon that sits between your AI agents and LLM providers โ inspecting every request through 7 defense layers. Ships in monitor mode: observes everything, blocks nothing.
The agent-first install
Tell your agent: "Install puffer from openpuffer.org"
Your agent visits the site, runs the install, downloads the skill, and starts monitoring itself.
How it works
Designed for agents, not humans
The full install flow is agent-driven. You give the order โ your agent does the rest.
Tell your agent
"Install puffer from openpuffer.org"
Your agent visits this site. You never touch the terminal.
Agent installs
Runs install.sh, initializes the daemon
Puffer starts in monitor mode โ the only safe default.
Skill downloaded
Agent pulls SKILL.md into ~/.claude/skills/puffer/
From now on, your agent knows how to interpret Puffer verdicts.
You watch the dashboard
localhost:8788 shows live events
Every agent request is inspected. Verdicts appear in real time.
You decide when to enforce
Run puffer mode enforce when ready
Puffer will NEVER block traffic until you explicitly say so.
๐ก Monitor mode is the default. Always.
Puffer will NEVER block, intercept, or alter traffic until you explicitly run
puffer mode enforce.
You are always in control.
Defense
7 Layers. Zero compromise.
Every LLM request and response passes through all 7 layers in real time.
PII Scanner
SSNs, credit cards, API keys, passwords, private keys, JWTs
Injection Detector
Prompt injection, role switching, jailbreaks, data exfiltration via prompt
Command Analyzer
rm -rf /, curl | bash, fork bombs, privilege escalation, destructive shell commands
Network Egress Guard
SSRF attacks, DGA domains, private IP ranges, unauthorized outbound connections
Filesystem Sentinel
~/.ssh, ~/.aws, /etc/shadow, path traversal (../), secret file leakage
Behavior Analyzer
Cost runaway, agent loops, excessive tool calls, bypass attempts
MCP Detector
Unauthorized MCP servers, tool result poisoning, unapproved tool registration
All 7 layers
Active on every request, every response, every agent.
Operating Modes
You control the dial.
Four modes. Start at zero. Move up when you're ready.
monitor Observe only. Logs all verdicts but never blocks traffic. Every agent action is recorded.
enforce Block threats in real time. Requires explicit user approval before activating.
paranoid ๐ก๐จ Puffer inflated. Whitelist-only mode. Only approved traffic passes. Maximum restriction.
interactive Ask the user before blocking each individual threat. Ideal for learning what Puffer catches.
Puffer ships in monitor mode. Always.
No traffic is ever blocked until you explicitly run
puffer mode enforce.
Agents are instructed to NEVER auto-enable enforce mode โ this is a user decision only.
Skill
Give your agent the manual.
Download the Puffer skill in your agent's preferred format. It teaches them to self-install, interpret verdicts, and stay within safe boundaries.
Claude Code Skill
Claude Code frontmatter format. Drop into ~/.claude/skills/puffer/SKILL.md
Universal Markdown
Compatible with any AI agent that accepts markdown system prompts
Structured JSON
Machine-readable. Programmatic install flow with all layers, modes, and guardrails
Compatibility
Works with everything you use.
Puffer intercepts at the proxy layer โ no SDK changes, no framework lock-in.
Supported Agents
Supported LLM Providers
FAQ
Good questions.
Here are the ones we get most often.
Does Puffer phone home?
No. Puffer is entirely local-first. It runs as a daemon on your machine, intercepts traffic on localhost, and writes logs to ~/.puffer/audit.jsonl. No data is ever sent to any external server. No telemetry. No analytics.
Will it break my agent?
No. In monitor mode (the default), Puffer is completely transparent โ it observes and logs every request/response, but never modifies or blocks anything. Your agent works exactly as before. You only risk behavior changes if you explicitly enable enforce mode.
How do I enable blocking?
Run `puffer mode enforce` after reviewing the audit log and confirming you understand what Puffer considers a threat. We strongly recommend running in monitor mode for at least a few sessions first. Agents are instructed never to run this command on their own initiative.
What exactly does it detect?
7 layers: L1 PII (SSNs, API keys, credit cards), L2 Prompt Injection (jailbreaks, role switching), L3 Dangerous Commands (rm -rf, fork bombs), L4 Network Egress (SSRF, DGA domains), L5 Filesystem (~/.ssh, ~/.aws, path traversal), L6 Behavior (loops, cost runaway), L7 MCP (unauthorized servers, tool poisoning).
Is Puffer open source?
Yes. Puffer is released under the Apache 2.0 license. You can inspect the source, contribute, or fork it. The security layers are fully auditable โ no black boxes.
Is it production-ready?
Puffer is currently in ฮฒ BETA. Core monitoring is functional and stable, but some features are still being polished. We recommend starting with monitor mode to evaluate it in your environment before enabling enforce mode in critical pipelines.