AgentSentry: LLM Agent Security Gateway

Inspiration

Defend LLM agents at the edge (<5ms) for DEF CON 34 RoboHack CTF (Agent Security).

Built

AgentSentry — Cloudflare Pages/Workers gateway. Pipeline: Classifier (heuristic + optional Workers AI judge) → Policy Engine (per-agent D1 policies) → Output Guard (hash-based leak detection) → Token-Bucket Rate Limit (DO + D1) → SHA-256 Audit Chain (DO, tamper-evident).

Stack

TypeScript, Bun, Wrangler, Cloudflare Workers/Pages/D1, Durable Objects, Vitest.

Challenges

Fixed WebWorker lib conflict (tsconfig); D1 exec drift; Pages [[route]] unsupported → _middleware.ts; blocked-tools budget; CI token missing workflow scope.

Results

Live: agent-sentry.pages.dev. 51/51 tests pass. tsc --noEmit clean.

Built With

• audit
• bun
• cloudflare-d1
• cloudflare-pages
• cloudflare-workers
• durable-objects
• edge-security
• llm-safety
• rate-limiting
• sha-256
• typescript
• vitest
• wrangler