TeamTree — Agent Safety Middleware

Inspiration

AI Agents are becoming capable of reading files, calling tools, using credentials, and running code. That power creates a visibility gap: a user prompt can reach an LLM and an execution runtime before anyone knows whether it contains an API key, personal data, a prompt-injection attempt, or an unsafe instruction.

We wanted to make Agent safety visible and actionable instead of treating it as an invisible background rule. Our goal was to build a real middleware boundary around an Agent Run: one that can protect sensitive data, stop high-risk requests before execution, and leave clear evidence of every decision.

What it does

TeamTree is an Agent platform with an end-to-end safety middleware layer.

Before an Agent Runner starts, the middleware evaluates prompts for provider secrets, generic credentials, personally identifiable information, and prompt-injection patterns. It can:

redact sensitive values from persisted chats, runs, and events;
replace inline sensitive values with opaque placeholders before sending a prompt to the LLM;
block high-risk prompt injection and destructive requests before they reach the Runner;
record allow, redact, block, timeout, cancellation, and output-limit events;
display an auditable timeline with the decision, boundary, reason, and timestamp.

The platform also includes Run Values, a controlled runtime-variable channel. Users can reference values with $VALUE_NAME in a prompt while keeping the actual value out of chat history. This helps with potential false positives and lets users explicitly authorize the Runner to use a secret without exposing the secret to the LLM. Users can choose value types such as AWS or GitHub and import or export value names or presets without sharing the underlying secret values.

How we built it

We built TeamTree as a React and TypeScript frontend with a Fastify backend. The core flow is:

User Prompt
  → Fastify API
  → AgentService + SafetyMiddleware
  → Safe persistence and safety-event store
  → CodexRunner / ContainerCodexRunner
  → Safety dashboard