The clearest pattern in this batch of Show HN launches is not a new capability. It is a change of location. A year ago, most agent safety tooling asked the model to behave: a system prompt, a judge, a second model reviewing the first. These tools assume the model will not, and place something deterministic between the agent and whatever it is about to touch. Some sit on the network path, some rewrite the payload in flight, some inspect the syntax tree of the action itself, and a couple simply watch the meter and pull the plug before you hit the ceiling.
Rewriting what leaves your machine
The most direct approach is to take the secret out of the request before it goes anywhere. Secret Guard is a local gateway that replaces credentials in outbound requests with equal-length realistic mocks and restores the real values in the response on the way back in. The equal-length detail matters more than it sounds: if redaction changed the token shape, the model's formatting and your tool parsing would both drift. Because restoration happens locally, the agent's tools keep working while the provider never sees a real key.
On the routing side, GoRoute puts a Go core with Rust SIMD acceleration in front of 338+ providers and 35 CLI agents, with multi-account pooling and autonomous cascades. The project quotes sub-millisecond latency and under 5MB of resident memory, which is the point: a gateway that adds meaningful overhead per call is a gateway people bypass.
Policy and budget at the protocol edge
Once MCP became the standard way agents reach tools, the obvious place to enforce policy became the MCP hop itself. SentinelMCP is a stateless policy firewall and token-cost proxy you drop in front of any MCP server. Every tool call is checked for identity, policy and budget before it reaches your infrastructure, and there is no database and no sticky session, so there is nothing new to operate at three in the morning.
CtxWise works one layer up, on the context files rather than the wire. It is a context firewall, MCP schema tree-shaker and token budget guard for Claude Code's CLAUDE.md, Codex's AGENTS.md and Cursor. The schema trimming half is underrated: a single bloated tool definition can quietly eat a meaningful share of a context window before any work happens.
Breaking the circuit instead of asking permission
Asking a model whether an action is safe adds latency and a second failure mode. Aw1 Circuit Breaker skips the question entirely and inspects the abstract syntax tree of the action, blocking dispatch deterministically with the project quoting sub-0.2ms evaluation. The same input always produces the same verdict, which is exactly what you want in a control path.
Databases get their own treatment. Vericto Proxy is a transparent PostgreSQL and MySQL wire-protocol proxy that stops destructive statements before they land. Because it works at the protocol level with no code changes, it covers the scripts and the humans as well as the agent, which is the honest way to frame the problem: agents were rarely the only thing issuing unguarded SQL.
Stopping injection before the first token
SentinelGate pushes the check earlier still, to what it calls Token 0. It evaluates prompt kinematics in memory with sub-millisecond overhead, before execution and before token spend, and seals each action in a tamper-evident Ed25519 evidence bag shaped for ISO 20022 financial rails. The interesting claim is not the detection but the ordering: blocking before spend means a blocked injection costs nothing.
Ceilings on the human side
Not every guardrail is adversarial. Some just stop you from wasting your own allowance. Peras watches Claude Code and Codex usage, projects where the week is heading, and pauses the agent or asks first when you cross the line you set. It also attributes spend by project directory, which answers the question people actually have once they see the number: which repo is eating this.
Plango covers the Mac side of the same concern, watching what coding agents do and stopping dangerous actions, listing every MCP server your tools connect to, checking skills and plugins before the agent trusts them, and moving plain-text keys out of .env files into the Keychain. It also handles the non-agent security basics, including phishing warnings and a view of which apps can reach your camera, microphone and keystrokes.
What makes the batch worth watching is the refusal behaviour. Three of these tools are built to stop rather than to degrade: Pith changes nothing when a saving would cost information, Aw1 blocks dispatch outright, and Vericto drops the statement rather than rewriting it. That is a different design philosophy from the usual "make it safer and carry on", and it tends to be what you want when the thing on the other side is a production database or a payment.
The through-line is that none of these tools try to make the model better behaved. They make the boundary around it executable, and several of them are willing to say no.