CI/CD enforcement

Fail CI pipelines and GitHub Actions when agent configurations violate security policy.

Page text and source link for your AI assistant. Nothing is sent automatically.

Overview

Foo Guard is a CI enforcement tool for AI agent configurations. When security policy fails, your pipeline fails.

CI job → Foo Guard CLI → Foo Guard API → deterministic analysis → exit code 0 or 1

Exit code	Meaning
`0`	Policy passed — CI job succeeds
`1`	Security policy failed — CI job fails (policy violation)
`2`	Operational or configuration error — CI job fails (not a policy finding)

Exit code 1 is the enforcement signal. Use it in any CI platform — GitHub Actions, GitLab CI, Azure Pipelines, Jenkins, CircleCI, and others.

Capability	Plan
CLI and CI enforcement	Pro (personal API key `agt_live_...`) or Team (organization service key `agt_team_...`)
Native GitHub Checks (Foo Guard Security)	Team GitHub App — see GitHub Checks
GitHub Action	Pro or Team API key

Free and Individual plans do not include CLI, API, or CI access.

export FOOGUARD_API_KEY=agt_live_...
fooguard scan ./agents --fail-on high --min-grade B

If the scan finds policy violations, the command exits 1 and your pipeline step fails.

agentguard:
  image: node:20
  script:
    - npm install -g fooguard
    - fooguard scan ./agents --fail-on high
  allow_failure: false

- script: |
    npm install -g fooguard
    fooguard scan ./agents --fail-on high
  displayName: Foo Guard security gate

For GitHub Actions specifically, use the Foo Guard GitHub Action.

Team customers can rely on native GitHub Checks from the GitHub App without adding a workflow step.

Effective policy merges organization policy, repository .fooguard.yml, and CLI flags. The strictest threshold wins.

Compare against a committed baseline file to fail CI when security posture regresses:

fooguard scan ./agents --fail-on high --baseline --baseline-path .agentguard.baseline.json