Oktsec
Oktsec is an open-source, self-hosted security monitoring platform for AI agents — real-time logging of every tool call (Read, Write, Bash, API, MCP) with a live dashboard showing events, agent topolo
About
Oktsec is an open-source, self-hosted security monitoring platform for AI agents — real-time logging of every tool call (Read, Write, Bash, API, MCP) with a live dashboard showing events, agent topology graphs, and threat detection. 217 detection rules across 14 categories (prompt injection, data exfiltration, credential leaks) with Aguara v0.9.1 context-aware scanning that brings false positives from ~40% to under 1%. Zero LLM in the detection core — Aho-Corasick pattern matching for speed. Supports Claude Code, OpenClaw, Gemini CLI, Cursor, Windsurf, and more.
Engineering teams running multiple AI agents in production who need real-time visibility into agent tool calls, multi-agent topology, and threat detection — particularly those who want deterministic (not LLM-based) security verdicts with a low false positive rate.
Pros & Cons
Pros
- check Zero LLM in detection core — deterministic Aho-Corasick matching means consistent, auditable verdicts without model cost or nondeterminism
- check Four-verdict system (clean, flag, quarantine, block) with per-tool egress policies — granular control beyond simple allow/deny
- check Agent topology graph maps inter-agent communication and traffic flows in real time — rare feature for multi-agent monitoring
- check 217 detection rules with claimed <1% false positive rate after Aguara v0.9.1 — better numbers than pattern-matching alternatives typically claim
- check Self-hosted and open source — no cloud data exfiltration risk from the monitoring tool itself
Cons
- close Dashboard-heavy product that requires deployment and maintenance overhead
- close 16 built-in egress presets are useful but custom egress configuration still requires manual work
- close Detection rules are pattern-based; novel or obfuscated attacks may still bypass
- close No cloud-hosted option — teams without infrastructure to self-host face a barrier
- close Relatively new product; production-scale validation data is limited
More Monitoring
Other tools in the same category.
