CI/CD enforcement

Fail CI pipelines and GitHub Actions when agent configurations violate security policy.

Overview

Foo Guard is a CI enforcement tool for AI agent configurations. When security policy fails, your pipeline fails.

CI job → Foo Guard CLI → Foo Guard API → deterministic analysis → exit code 0 or 1

| Exit code | Meaning |

|-----------|---------|

| `0` | Policy passed — CI job succeeds |

| `1` | Security policy failed — CI job fails (policy violation) |

| `2` | Operational or configuration error — CI job fails (not a policy finding) |

Exit code 1 is the enforcement signal. Use it in any CI platform — GitHub Actions, GitLab CI, Azure Pipelines, Jenkins, CircleCI, and others.

| Capability | Plan |

|------------|------|

| CLI and CI enforcement | **Pro** (personal API key `agt_live_...`) or **Team** (organization service key `agt_team_...`) |

| Native GitHub Checks (Foo Guard Security) | **Team** GitHub App — see [GitHub Checks](/docs/github/github-checks) |

| GitHub Action | **Pro** or **Team** API key |

Free and Individual plans do not include CLI, API, or CI access.

export FOOGUARD_API_KEY=agt_live_...
fooguard scan ./agents --fail-on high --min-grade B

If the scan finds policy violations, the command exits 1 and your pipeline step fails.

agentguard:
  image: node:20
  script:
    - npm install -g @agentguard/cli
    - fooguard scan ./agents --fail-on high
  allow_failure: false

- script: |
    npm install -g @agentguard/cli
    fooguard scan ./agents --fail-on high
  displayName: Foo Guard security gate

For GitHub Actions specifically, use the Foo Guard GitHub Action.

Team customers can rely on native GitHub Checks from the GitHub App without adding a workflow step.

Effective policy merges organization policy, repository .fooguard.yml, and CLI flags. The strictest threshold wins.

Compare against a committed baseline file to fail CI when security posture regresses:

fooguard scan ./agents --fail-on high --baseline --baseline-path .agentguard.baseline.json