Moat auto-detects your environment and generates a hardened security config for your self-hosted AI agents. Under 2 minutes. Zero YAML expertise needed.
Frameworks give you powerful agents. They don't give you security. That gap is on you.
By default, your agent can read any file your OS user can. Passwords, SSH keys, dotfiles — all reachable.
A compromised agent can exfiltrate data to any server. Without egress filtering, you won't know until it's too late.
API keys in .env files. Any tool call the agent makes can read them. Leaked once, rotated forever.
The default docker-compose runs as root with all capabilities. Container escape = full host compromise.
Turn on only what you need. Each layer generates a drop-in config file — no manual YAML editing.
Tailscale ACL + iptables rules that block C2 callbacks and limit agent-to-agent traffic
Drop-in docker-compose.yml: cap_drop ALL, read-only root, no-new-privileges, resource limits
API key auth, IP allowlist, per-endpoint rate limiting, request logging
Self-hosted Infisical server for API keys — no more secrets in .env files
Block dangerous skill categories. Optional LLM-as-Judge for ambiguous requests.
Default-deny tool permissions. Every tool the agent can call is explicitly allowlisted per role.
Falco syscall monitoring + Prometheus alerts for anomaly detection
Moat never installs anything automatically. It generates files — you stay in control.
One curl command. Zero dependencies. Python stdlib only.
Moat scans your hardware, OS, Docker version, Tailscale, and installed security tools.
Browser wizard or terminal UI. Moat recommends based on what it found.
Copy generated configs into place. Follow the included step-by-step guide.
Existing tools focus on sandboxing agent code execution. Moat hardens the host and network around the agent.
| Capability | microsandbox | DIY YAML | Moat |
|---|---|---|---|
| Sandboxes code execution | ✓ | — | — |
| Docker hardening | — | ⚠️ Manual | ✓ |
| Network egress filtering | — | ⚠️ Manual | ✓ |
| Secrets management | — | ⚠️ Manual | ✓ |
| Restricts agent tool permissions | — | ⚠️ Manual | ✓ |
| Setup wizard for non-experts | — | — | ✓ |
| Environment auto-detection | — | — | ✓ |
Layers 1–4 are framework-agnostic. Layers 5–7 add framework-specific hardening where available.
Free. No account. No server. Just a Python script and a browser.