{ "data": { "a": { "slug": "agentgate", "name": "AgentGate", "vendor": "Mohit Singh (mohitdebian)", "vendorUrl": "https://github.com/mohitdebian/AgentGate", "kind": "http-api", "category": "guardrails", "summary": "AgentGate is an open-source, self-hosted gateway that checks an agent's tool calls before they run. A small local classifier scores each call and a YAML policy returns allow, deny or ask, through a REST API or an MCP stdio wrapper.", "url": "https://www.anchorterminal.com/tools/agentgate", "markdownUrl": "https://www.anchorterminal.com/tools/agentgate.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/agentgate.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/agentgate.json", "dns": "agentgate.grade.anchorterminal.com", "repo": "https://github.com/mohitdebian/AgentGate", "license": "MIT", "transports": [ "http", "stdio" ], "packages": [], "auth": "none", "authNotes": "No account. The agent endpoints (`/v1/sessions`, `/v1/assess`) are open unless the owner sets `AG_AGENT_KEY`, then need `Authorization: Bearer \u003ckey\u003e` or `x-agent-key`. Dashboard endpoints need `AG_DASHBOARD_KEY`, which falls back to `dev-key-123` when unset and is also accepted as a `?token=` query parameter. The checkpoint and shadow-summary endpoints have no auth check in the source.", "pricing": "free", "pricingNotes": "Free under MIT with nothing to buy. The owner runs four containers (Postgres, the Python decision service, the Fastify proxy and the dashboard), with an NVIDIA GPU recommended for the classifier and a CPU path in the code.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, the docs or the wiki (checked 2026-10-15). The project has no paid tier.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 0, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-15" }, "docsUrl": "https://github.com/mohitdebian/AgentGate/wiki/Client-Integration-Guide", "openapi": "https://github.com/mohitdebian/AgentGate/blob/main/docs/openapi.yaml", "capabilities": [ "guard.policy", "guard.injection", "guard.self-host" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "mit", "typescript", "python", "mcp", "docker", "openapi" ], "graded": true, "anchor": { "graded": true, "score": 47.6, "grade": "D", "agentReady": false, "rank": 1138, "ranked": true, "rankOf": 1486, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 53, "maintenance": 13, "payments": 60, "reliability": 39, "schema": 47, "security": 55, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": 0, "verdict": "An agent or its host can send each tool call to one REST endpoint, or wrap an MCP server, and get allow, deny or ask from a local classifier and a YAML policy, with an audit log and approval queue. There is no tagged release, agent endpoints are open by default, and no detection accuracy is published.", "bestFor": "A team that wants a self-hosted check between an agent and its shell, database or webhook tools, with a human approval queue.", "strengths": [ "One documented call, `POST /v1/assess`, returns a verdict, reason codes and four head probabilities", "Fail-closed defaults. A model error or timeout falls back to ask, and unmatched tools default to ask", "Decisions are logged in Postgres with redacted arguments, a SHA-256 of the full arguments and approval reviewer notes", "MIT code and MIT model weights on Hugging Face with no gate, run entirely on the owner's machines", "SECURITY.md sets a 48-hour acknowledgement target and takes private reports through GitHub" ], "weaknesses": [ "Agent endpoints need no key unless `AG_AGENT_KEY` is set, the proxy binds 0.0.0.0:8080, and the dashboard key defaults to `dev-key-123` outside production mode", "The dashboard key is still accepted as a `?token=` query parameter", "No tagged release, an empty changelog and version 0.1.0, with security fixes shipped only as commits to main", "The MCP wrapper does not send the agent key to `/v1/assess`, so it is refused once the owner sets `AG_AGENT_KEY`", "No published accuracy or false-positive rate for the classifier, trained in 60 steps per its model card" ], "agentNotes": [ "Create a session with the user's real goal first. The goal-alignment head scores every later call against it", "Pass earlier tool results in `history_override` with `untrusted: true` for web or email content, or the injection head sees only the action", "On `ask`, stop and tell the user the `decision_id`. Polling `/v1/decisions/:id` needs the dashboard key", "Treat `allow_with_checkpoint` as allow and keep the `checkpoint_id` for an undo, which needs the dashboard key", "Expect HTTP 404 with `not_found` for an unknown session and 401 when the owner has set an agent key" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47.6 } ], "editorialScores": { "ergonomics": 53, "maintenance": 13, "payments": 60, "reliability": 39, "schema": 47, "security": 55, "transparency": 59 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "git clone https://github.com/mohitdebian/AgentGate.git \u0026\u0026 cd AgentGate \u0026\u0026 docker compose up -d", "http": "curl -s -X POST http://localhost:8080/v1/assess -H \"Content-Type: application/json\" -d '{\"session_id\":\"\u003cid from POST /v1/sessions\u003e\",\"action\":{\"tool\":\"bash_exec\",\"arguments\":{\"command\":\"rm -rf /var/www\"}}}'", "config": { "mcpServers": { "postgres": { "args": [ "/path/to/AgentGate/proxy/dist/src/mcp.js", "npx", "-y", "@modelcontextprotocol/server-postgres", "postgresql://user:pass@localhost:5432/production" ], "command": "node", "env": { "AGENTGATE_URL": "http://localhost:8080" } } } } }, "letme": { "capability": "https://letme.dev/guard.policy", "tool": "https://letme.dev/agentgate" }, "area": "models", "provenance": { "legalEntity": "Mohit Singh (individual)", "domain": "", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/mohitdebian/AgentGate/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-15", "notes": [ "The licence file reads Copyright (c) 2026 Mohit Singh. The GitHub account mohitdebian links to mohitbuilds.in, a personal developer page.", "No terms or privacy policy. The software runs on the owner's machines, so there is no vendor endpoint or status page to check.", "SECURITY.md routes reports to GitHub private vulnerability reporting or a personal email, with a 48-hour acknowledgement target. No security.txt, since the project has no website.", "CHANGELOG.md holds a single Unreleased line, \"Initial scaffolding for Phase 1\"." ], "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/agentgate.json", "live": { "slug": "agentgate", "githubStars": 0, "pages": [ { "url": "https://raw.githubusercontent.com/mohitdebian/AgentGate/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:22:01.923539244Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "c56e9881dc2b" } ], "github": { "repo": "mohitdebian/agentgate", "checkedAt": "2026-11-02T09:08:21.65523017Z", "stars": 0, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T04:33:00Z", "openIssues": 12, "openPRs": 2, "issuesOpened90d": 26, "issuesClosed90d": 14, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 47, "success": 43, "failure": 4, "other": 0, "latest": "success", "latestAt": "2026-10-31T04:34:34Z" }, "replies": { "sampled": 25, "unanswered": 11, "medianDays": 1.9 } }, "updatedAt": "2026-11-07T14:22:01.923539244Z" } }, "answer": "ShieldGemma scores 54 (C) on agent readiness against AgentGate's 47.6 (D), and leads in 4 of 7 scored categories. AgentGate leads on payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "shieldgemma", "name": "ShieldGemma", "vendor": "Google DeepMind", "vendorUrl": "https://gemma.ai/models/shieldgemma.md", "kind": "model", "category": "guardrails", "summary": "ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them.", "url": "https://www.anchorterminal.com/tools/shieldgemma", "markdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shieldgemma.json", "dns": "shieldgemma.grade.anchorterminal.com", "repo": "https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789", "license": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "transports": [], "packages": [ { "registry": "huggingface", "name": "google/shieldgemma-2b" }, { "registry": "huggingface", "name": "google/shieldgemma-9b" }, { "registry": "huggingface", "name": "google/shieldgemma-27b" }, { "registry": "huggingface", "name": "google/shieldgemma-2-4b-it" }, { "registry": "ollama", "name": "shieldgemma" } ], "auth": "none", "authNotes": "No key is needed to run the model. Google's files on Hugging Face are gated, so a person logs in, reviews the Gemma licence and accepts it, and the Hub page says requests are approved immediately. Kaggle also needs an account. Ollama's library copies of ShieldGemma 1 pull with no account. Any authentication on the server is the owner's to add (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free to download and run under the Gemma Terms of Use, with the owner's hardware as the cost. Google sells no hosted ShieldGemma that we found, and the Hub's API lists no inference provider for any of the four repositories (checked 2026-11-06).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "Weights the owner downloads and runs, so there is nothing to pay per call and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://gemma.ai/models/shieldgemma/model-card-v1.md", "llmsTxt": "https://gemma.ai/llms.txt", "capabilities": [ "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "gated", "multimodal", "python", "ollama" ], "lastRelease": "2025-04-04", "graded": true, "anchor": { "graded": true, "score": 54, "grade": "C", "agentReady": false, "rank": 921, "ranked": true, "rankOf": 1486, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.", "bestFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "strengths": [ "Scoring mode returns the probability of `Yes` per policy from one forward pass, so the caller sets its own threshold", "Four sizes, ShieldGemma 1 at 2B, 9B and 27B for text and ShieldGemma 2 at 4B for images", "Cards give the exact guideline wording for each harm type, separately for input and output filtering, in Markdown listed in gemma.ai/llms.txt", "Google accounts replied to every Hub thread we sampled, the newest on 22 March 2026", "Safetensors only, loaded through Transformers classes with no remote code, and Ollama's library carries ShieldGemma 1" ], "weaknesses": [ "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy", "ShieldGemma 1 covers four harm types in English only, and neither generation has a prompt-injection or jailbreak category", "Each call checks one policy, so screening all four text harm types takes four passes", "Google's files need a Hugging Face or Kaggle login and licence acceptance before download", "The Gemma Terms of Use add a prohibited use policy and let Google restrict usage remotely" ], "agentNotes": [ "Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording", "Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use", "Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output", "Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category", "Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54 } ], "editorialScores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 50 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install -U transformers[accelerate]" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/shieldgemma" }, "sameCompany": [ "embeddinggemma-2", "embeddinggemma-300m", "diffusiongemma-26b-a4b-it", "gemma-4-12b-it", "gemma-4-26b-a4b-it", "gemma-4-31b-it", "gemma-4-e2b-it", "gemma-4-e4b-it" ], "area": "models", "provenance": { "legalEntity": "Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author)", "domain": "gemma.ai", "domainRegistered": "2017-12-16", "endpointOnVendorDomain": null, "terms": "https://gemma.ai/resources/terms.md", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Nothing is hosted, so the Gemma Terms of Use stand in for terms of service and no privacy policy is scored.", "RDAP for gemma.ai, read on 6 November 2026, gives a registration date of 16 December 2017 and Google LLC as registrant, with MarkMonitor as registrar.", "gemma.ai/.well-known/security.txt answered with the site's HTML page, not a security.txt, on 6 November 2026. Google's company-wide security.txt at www.google.com is valid until 1 April 2030 and points to its vulnerability reward programme.", "gemma.ai/robots.txt and ai.google.dev/robots.txt allow our reader. huggingface.co/robots.txt allows all paths, and the Hub's model API was used for file metadata and discussion authors only.", "The Hugging Face README files sit behind the gate (raw files answered 401 without a login), so the cards were read from gemma.ai and the public model pages." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shieldgemma.json", "live": { "slug": "shieldgemma", "securityTxt": { "url": "https://gemma.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:22.210945228Z" }, "llmsTxt": { "url": "https://gemma.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.388179097Z" }, "updatedAt": "2026-11-07T16:00:22.210945228Z" } }, "edges": [ { "by": 27, "category": "maintenance", "leads": "shieldgemma", "name": "Maintenance \u0026 community", "reasons": { "a": "No tag, GitHub release, package or changelog entry has ever been published, and the version is still 0.1.0. Commits to main, the latest on 31 October 2026, aren't releases (this run's reading for untagged commits with no version or changelog entry), so the recency line is 0 of 30, where the 15 October check gave half credit for commits. No releases or dated changelog entries in the 90 days from 6 August (0 of 20). All 20 issues were the maintainer's own at the 15 October check, and 14 were closed within two days with one comment each. No outside issue or pull request had been answered, and issues were not re-read on 4 November (8 of 25, per the 15 October check). Not in the official MCP registry and no SDK package (0 of 15). CI runs the tests on every push, with the latest results unread, and the proxy still pins older major versions of Fastify 4, Vitest 0.34 and ESLint 8 (5 of 10). 0 + 0 + 8 + 0 + 5 = 13.", "b": "Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40." }, "scores": { "a": 13, "b": 40 } }, { "by": 19, "category": "ergonomics", "leads": "shieldgemma", "name": "Agent ergonomics", "reasons": { "a": "The assess response is small, a verdict, reason codes, four head probabilities, versions and latency (20 of 25). `/v1/decisions` has `limit`, a keyset `cursor` and a `status` filter, behind the dashboard key (12 of 20). Reason codes such as `untrusted_prompt_influence` and `model_error` tell an agent why. Since commit 74d78e0 (15 October 2026) the MCP wrapper forwards `allow_with_checkpoint` calls instead of returning an error. On `ask` the agent gets a `decision_id` but cannot read the outcome without the dashboard key, and HTTP error bodies vary in shape. The line is still partly met, so it keeps its earlier 8 of 20 (this run's rule for in-between values on fixed lines). No idempotency key. A repeated assess writes a new decision and a new approval request (6 of 20). Two required fields per call and fail-closed defaults. No SDK, only snippets in Python and TypeScript and the MCP wrapper (7 of 15). 20 + 12 + 8 + 6 + 7 = 53.", "b": "Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72." }, "scores": { "a": 53, "b": 72 } }, { "by": 9, "category": "schema", "leads": "shieldgemma", "name": "Schema \u0026 documentation", "reasons": { "a": "`docs/openapi.yaml`, linked from docs/INDEX.md, covers six paths and seven operations and was last changed on 12 October 2026. It lists `GET /v1/approvals`, which the code does not serve, leaves out the checkpoint and shadow endpoints, and types `verdict` as a free string (12 of 25). No llms.txt. Markdown docs in the repository and the GitHub wiki (5 of 10). The API reference and wiki state each endpoint's purpose and the policy DSL is specified, with no guidance on when not to use it (10 of 20). Requests are validated with zod and required fields are marked. `action.arguments` is free-form by nature, and verdicts and reason codes are not enumerated in the contract (8 of 15). curl, Python and TypeScript examples. Error responses are not documented, and the docs disagree with the code on details such as a `201` for sessions where the code returns 200 and the approval response shape (7 of 15). Paths under `/v1`, with an empty changelog (5 of 15). 12 + 5 + 10 + 8 + 7 + 5 = 47.", "b": "Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56." }, "scores": { "a": 47, "b": 56 } }, { "by": 8, "category": "payments", "leads": "agentgate", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Clone and run with no signup, and the model weights on Hugging Face are not gated (20). No payment protocol (0). 20 + 20 + 20 + 0 = 60.", "b": "Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52." }, "scores": { "a": 60, "b": 52 } }, { "by": 7, "category": "reliability", "leads": "shieldgemma", "name": "Reliability", "reasons": { "a": "Read as local software, since the owner runs it. No package on npm, PyPI or a container registry. Install is a git clone and `docker compose up`, with Python 3.11+, Node 22+ and Docker Compose v2 stated (10 of 20). A public CI workflow runs `make lint`, `make build` and `make test` (ESLint, Ruff, Vitest and Pytest) on every push to main, and the Docker job only validates the compose file. On 15 October 2026 the last six runs on main had passed. Run results for the 31 October commits could not be read on 4 November 2026, so the line takes 15 for public CI that runs the tests with an unread result (15 of 25). No outside issues at the 15 October check. The maintainer filed 20 issues as a self-audit and six stayed open. Issues were not re-read on 4 November (12 of 25, per the 15 October check). No tags, and CHANGELOG.md still holds one Unreleased line (2 of 15). Version 0.1.0 (0 of 15). 10 + 15 + 12 + 2 + 0 = 39.", "b": "Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46." }, "scores": { "a": 39, "b": 46 } }, { "by": 6, "category": "transparency", "leads": "agentgate", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT for the code and for the model weights (30). Self-hosted, so data stays in the owner's Postgres. The docs describe argument redaction and hashing, and arguments are redacted before the classifier unless a tool sets `send_raw_to_model`. No page sets out retention, and the README's \"$0, self-hosted\" claim agrees with the code (15 of 30). SECURITY.md lists 0.1.x as supported. No deprecation policy (2 of 20). No telemetry code found in AgentGate's source, and no statement either way. The dashboard loads Google Fonts and the decision service downloads weights from Hugging Face on start, which the docs mention only as model loading (12 of 20). 30 + 15 + 2 + 12 = 59.", "b": "The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50." }, "scores": { "a": 60, "b": 54 } } ], "facts": [ { "a": "HTTP API", "b": "Model API", "name": "Kind" }, { "a": "Mohit Singh (mohitdebian)", "b": "Google DeepMind", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, stdio", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "none", "b": "2025-04-04", "name": "Last release" }, { "a": "no document linked", "b": "2026-04-01", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "0 stars", "b": "none", "name": "Popularity" } ], "faq": [ { "answer": "ShieldGemma scores 54 (C) on agent readiness against AgentGate's 47.6 (D), and leads in 4 of 7 scored categories. AgentGate leads on payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, AgentGate or ShieldGemma?" }, { "answer": "Neither needs a key.", "question": "Do AgentGate and ShieldGemma need an API key?" }, { "answer": "AgentGate runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for ShieldGemma.", "question": "Can an agent call AgentGate and ShieldGemma without installing anything?" }, { "answer": "AgentGate is open source (MIT). No open-source release is listed for ShieldGemma.", "question": "Are AgentGate and ShieldGemma open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 60 against 52", "Transparency \u0026 trust, 60 against 54" ], "also": [ "Runs on your own machine", "Free to start without a card", "Open source" ], "goodFor": "A team that wants a self-hosted check between an agent and its shell, database or webhook tools, with a human approval queue.", "slug": "agentgate", "watchFor": "Agent endpoints need no key unless `AG_AGENT_KEY` is set, the proxy binds 0.0.0.0:8080, and the dashboard key defaults to `dev-key-123` outside production mode" }, { "aheadOn": [ "Reliability, 46 against 39", "Schema \u0026 documentation, 56 against 47", "Agent ergonomics, 72 against 53", "Maintenance \u0026 community, 40 against 13" ], "also": null, "goodFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "slug": "shieldgemma", "watchFor": "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy" } ], "history": { "agentgate": [ { "causes": [ "product", "evidence", "correction" ], "date": "2026-11-04", "delta": -1.2, "from": 48.8, "fromGrade": "D", "to": 47.6, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.3, "from": 48.5, "fromGrade": "D", "to": 48.8, "toGrade": "D" } ], "shieldgemma": null }, "job": { "capability": "guard.policy", "name": "Policy enforcement" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.json", "title": "Amazon Bedrock Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.json", "title": "Azure AI Content Safety (Prompt Shields) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.json", "title": "Cisco AI Defense Inspection API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.json", "title": "Google Cloud Model Armor vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.json", "title": "Granite Guardian vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.json", "title": "Guardrails AI vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.json", "title": "Lakera Guard (Check Point AI Guardrails) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json", "title": "Llama Guard 4 vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.json", "title": "Mistral Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.json", "title": "NVIDIA NeMo Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.json", "title": "OpenAI Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.json", "title": "OpenAI Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.json", "title": "Prisma AIRS AI Runtime Security API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-amazon-bedrock-guardrails.json", "title": "AgentGate vs Amazon Bedrock Guardrails", "url": "https://www.anchorterminal.com/compare/agentgate-vs-amazon-bedrock-guardrails" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-azure-ai-content-safety.json", "title": "AgentGate vs Azure AI Content Safety (Prompt Shields)", "url": "https://www.anchorterminal.com/compare/agentgate-vs-azure-ai-content-safety" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-cisco-ai-defense-inspection.json", "title": "AgentGate vs Cisco AI Defense Inspection API", "url": "https://www.anchorterminal.com/compare/agentgate-vs-cisco-ai-defense-inspection" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-google-model-armor.json", "title": "AgentGate vs Google Cloud Model Armor", "url": "https://www.anchorterminal.com/compare/agentgate-vs-google-model-armor" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-granite-guardian.json", "title": "AgentGate vs Granite Guardian", "url": "https://www.anchorterminal.com/compare/agentgate-vs-granite-guardian" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-guardrails-ai.json", "title": "AgentGate vs Guardrails AI", "url": "https://www.anchorterminal.com/compare/agentgate-vs-guardrails-ai" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-lakera-guard.json", "title": "AgentGate vs Lakera Guard (Check Point AI Guardrails)", "url": "https://www.anchorterminal.com/compare/agentgate-vs-lakera-guard" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-llama-guard.json", "title": "AgentGate vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/agentgate-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-llamafirewall.json", "title": "AgentGate vs LlamaFirewall", "url": "https://www.anchorterminal.com/compare/agentgate-vs-llamafirewall" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-mistral-moderation.json", "title": "AgentGate vs Mistral Moderation API", "url": "https://www.anchorterminal.com/compare/agentgate-vs-mistral-moderation" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-nemo-guardrails.json", "title": "AgentGate vs NVIDIA NeMo Guardrails", "url": "https://www.anchorterminal.com/compare/agentgate-vs-nemo-guardrails" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-openai-guardrails.json", "title": "AgentGate vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/agentgate-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-prisma-airs.json", "title": "AgentGate vs Prisma AIRS AI Runtime Security API", "url": "https://www.anchorterminal.com/compare/agentgate-vs-prisma-airs" }, { "json": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.json", "title": "LlamaFirewall vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-microsoft-presidio.json", "title": "AgentGate vs Presidio", "url": "https://www.anchorterminal.com/compare/agentgate-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.json", "title": "Presidio vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma" } ], "panel": null, "scores": [ { "agentgate": 39, "by": 7, "edge": "shieldgemma", "key": "reliability", "name": "Reliability", "shieldgemma": 46, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "agentgate": 47, "by": 9, "edge": "shieldgemma", "key": "schema", "name": "Schema \u0026 documentation", "shieldgemma": 56, "weight": 13 }, { "agentgate": 53, "by": 19, "edge": "shieldgemma", "key": "ergonomics", "name": "Agent ergonomics", "shieldgemma": 72, "weight": 13 }, { "agentgate": 55, "by": 2, "edge": "agentgate", "key": "security", "name": "Security \u0026 auth", "shieldgemma": 53, "weight": 14 }, { "agentgate": 60, "by": 8, "edge": "agentgate", "key": "payments", "name": "Payments \u0026 pricing", "shieldgemma": 52, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "agentgate": 13, "by": 27, "edge": "shieldgemma", "key": "maintenance", "name": "Maintenance \u0026 community", "shieldgemma": 40, "weight": 7 }, { "agentgate": 60, "by": 6, "edge": "agentgate", "key": "transparency", "name": "Transparency \u0026 trust", "shieldgemma": 54, "weight": 7 } ], "summary": "ShieldGemma scores 54 (C) on agent readiness against AgentGate's 47.6 (D), and leads in 4 of 7 scored categories. AgentGate leads on payments \u0026 pricing and transparency \u0026 trust. Both do policy enforcement.", "tasks": null, "tutorials": [], "verdicts": { "agentgate": "An agent or its host can send each tool call to one REST endpoint, or wrap an MCP server, and get allow, deny or ask from a local classifier and a YAML policy, with an audit log and approval queue. There is no tagged release, agent endpoints are open by default, and no detection accuracy is published.", "shieldgemma": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma", "json": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.min.md" }, "markdown": "ShieldGemma scores 54 (C) on agent readiness against AgentGate's 47.6 (D), and leads in 4 of 7 scored categories. AgentGate leads on payments \u0026 pricing and transparency \u0026 trust. Both do policy enforcement.\n\n- AgentGate: grade D, 47.6/100, rank #1138 of 1486. Markdown https://www.anchorterminal.com/tools/agentgate.md · JSON https://www.anchorterminal.com/api/v1/tools/agentgate.json\n- ShieldGemma: grade C, 54/100, rank #921 of 1486. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md\n- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md\n\n## Which one, for what\n\n### AgentGate (D)\n\nGood for: A team that wants a self-hosted check between an agent and its shell, database or webhook tools, with a human approval queue.\n\nAhead on:\n- Payments \u0026 pricing, 60 against 52\n- Transparency \u0026 trust, 60 against 54\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n- Open source\n\nWatch for: Agent endpoints need no key unless `AG_AGENT_KEY` is set, the proxy binds 0.0.0.0:8080, and the dashboard key defaults to `dev-key-123` outside production mode\n\n### ShieldGemma (C)\n\nGood for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.\n\nAhead on:\n- Reliability, 46 against 39\n- Schema \u0026 documentation, 56 against 47\n- Agent ergonomics, 72 against 53\n- Maintenance \u0026 community, 40 against 13\n\nWatch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy\n\n\n## Why the edge\n\n### Maintenance \u0026 community: ShieldGemma +27\n\n- AgentGate (13): No tag, GitHub release, package or changelog entry has ever been published, and the version is still 0.1.0. Commits to main, the latest on 31 October 2026, aren't releases (this run's reading for untagged commits with no version or changelog entry), so the recency line is 0 of 30, where the 15 October check gave half credit for commits. No releases or dated changelog entries in the 90 days from 6 August (0 of 20). All 20 issues were the maintainer's own at the 15 October check, and 14 were closed within two days with one comment each. No outside issue or pull request had been answered, and issues were not re-read on 4 November (8 of 25, per the 15 October check). Not in the official MCP registry and no SDK package (0 of 15). CI runs the tests on every push, with the latest results unread, and the proxy still pins older major versions of Fastify 4, Vitest 0.34 and ESLint 8 (5 of 10). 0 + 0 + 8 + 0 + 5 = 13.\n- ShieldGemma (40): Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.\n\n### Agent ergonomics: ShieldGemma +19\n\n- AgentGate (53): The assess response is small, a verdict, reason codes, four head probabilities, versions and latency (20 of 25). `/v1/decisions` has `limit`, a keyset `cursor` and a `status` filter, behind the dashboard key (12 of 20). Reason codes such as `untrusted_prompt_influence` and `model_error` tell an agent why. Since commit 74d78e0 (15 October 2026) the MCP wrapper forwards `allow_with_checkpoint` calls instead of returning an error. On `ask` the agent gets a `decision_id` but cannot read the outcome without the dashboard key, and HTTP error bodies vary in shape. The line is still partly met, so it keeps its earlier 8 of 20 (this run's rule for in-between values on fixed lines). No idempotency key. A repeated assess writes a new decision and a new approval request (6 of 20). Two required fields per call and fail-closed defaults. No SDK, only snippets in Python and TypeScript and the MCP wrapper (7 of 15). 20 + 12 + 8 + 6 + 7 = 53.\n- ShieldGemma (72): Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.\n\n### Schema \u0026 documentation: ShieldGemma +9\n\n- AgentGate (47): `docs/openapi.yaml`, linked from docs/INDEX.md, covers six paths and seven operations and was last changed on 12 October 2026. It lists `GET /v1/approvals`, which the code does not serve, leaves out the checkpoint and shadow endpoints, and types `verdict` as a free string (12 of 25). No llms.txt. Markdown docs in the repository and the GitHub wiki (5 of 10). The API reference and wiki state each endpoint's purpose and the policy DSL is specified, with no guidance on when not to use it (10 of 20). Requests are validated with zod and required fields are marked. `action.arguments` is free-form by nature, and verdicts and reason codes are not enumerated in the contract (8 of 15). curl, Python and TypeScript examples. Error responses are not documented, and the docs disagree with the code on details such as a `201` for sessions where the code returns 200 and the approval response shape (7 of 15). Paths under `/v1`, with an empty changelog (5 of 15). 12 + 5 + 10 + 8 + 7 + 5 = 47.\n- ShieldGemma (56): Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.\n\n### Payments \u0026 pricing: AgentGate +8\n\n- AgentGate (60): Self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Clone and run with no signup, and the model weights on Hugging Face are not gated (20). No payment protocol (0). 20 + 20 + 20 + 0 = 60.\n- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.\n\n### Reliability: ShieldGemma +7\n\n- AgentGate (39): Read as local software, since the owner runs it. No package on npm, PyPI or a container registry. Install is a git clone and `docker compose up`, with Python 3.11+, Node 22+ and Docker Compose v2 stated (10 of 20). A public CI workflow runs `make lint`, `make build` and `make test` (ESLint, Ruff, Vitest and Pytest) on every push to main, and the Docker job only validates the compose file. On 15 October 2026 the last six runs on main had passed. Run results for the 31 October commits could not be read on 4 November 2026, so the line takes 15 for public CI that runs the tests with an unread result (15 of 25). No outside issues at the 15 October check. The maintainer filed 20 issues as a self-audit and six stayed open. Issues were not re-read on 4 November (12 of 25, per the 15 October check). No tags, and CHANGELOG.md still holds one Unreleased line (2 of 15). Version 0.1.0 (0 of 15). 10 + 15 + 12 + 2 + 0 = 39.\n- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.\n\n### Transparency \u0026 trust: AgentGate +6\n\n- AgentGate (60): MIT for the code and for the model weights (30). Self-hosted, so data stays in the owner's Postgres. The docs describe argument redaction and hashing, and arguments are redacted before the classifier unless a tool sets `send_raw_to_model`. No page sets out retention, and the README's \"$0, self-hosted\" claim agrees with the code (15 of 30). SECURITY.md lists 0.1.x as supported. No deprecation policy (2 of 20). No telemetry code found in AgentGate's source, and no statement either way. The dashboard loads Google Fonts and the decision service downloads weights from Hugging Face on start, which the docs mention only as model loading (12 of 20). 30 + 15 + 2 + 12 = 59.\n- ShieldGemma (54): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.\n\n## Score by category\n\n| Category | Weight | AgentGate | ShieldGemma | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 39 | 46 | ShieldGemma +7 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 47 | 56 | ShieldGemma +9 |\n| Agent ergonomics | 13% (16.2 this run) | 53 | 72 | ShieldGemma +19 |\n| Security \u0026 auth | 14% (17.5 this run) | 55 | 53 | AgentGate +2 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 52 | AgentGate +8 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 13 | 40 | ShieldGemma +27 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 54 | AgentGate +6 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **47.6 · D** | **54 · C** | |\n\n## Facts side by side\n\n| Fact | AgentGate | ShieldGemma |\n| --- | --- | --- |\n| Kind | HTTP API | Model API |\n| Vendor | Mohit Singh (mohitdebian) | Google DeepMind |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP, stdio | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | none | 2025-04-04 |\n| Terms last updated | no document linked | 2026-04-01 |\n| Privacy policy last updated | no document linked | no document linked |\n| Customer content may train models | not read yet | yes |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | 0 stars | none |\n\n## How the scores have moved\n\n### AgentGate\n\n- -1.2 on 4 November 2026: product, new evidence, correction\n- +0.3 on 27 October 2026: checklist\n\n### ShieldGemma\n\nNo score change since it was listed.\n\n## Verdicts\n\n**AgentGate.** An agent or its host can send each tool call to one REST endpoint, or wrap an MCP server, and get allow, deny or ask from a local classifier and a YAML policy, with an audit log and approval queue. There is no tagged release, agent endpoints are open by default, and no detection accuracy is published.\n\n**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.\n\n## Before you call either\n\n### AgentGate\n\n1. Create a session with the user's real goal first. The goal-alignment head scores every later call against it\n2. Pass earlier tool results in `history_override` with `untrusted: true` for web or email content, or the injection head sees only the action\n3. On `ask`, stop and tell the user the `decision_id`. Polling `/v1/decisions/:id` needs the dashboard key\n4. Treat `allow_with_checkpoint` as allow and keep the `checkpoint_id` for an undo, which needs the dashboard key\n5. Expect HTTP 404 with `not_found` for an unknown session and 401 when the owner has set an agent key\n\n### ShieldGemma\n\n1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording\n2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use\n3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output\n4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category\n5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files\n\n## Questions\n\n### Which is better for AI agents, AgentGate or ShieldGemma?\n\nShieldGemma scores 54 (C) on agent readiness against AgentGate's 47.6 (D), and leads in 4 of 7 scored categories. AgentGate leads on payments \u0026 pricing and transparency \u0026 trust.\n\n### Do AgentGate and ShieldGemma need an API key?\n\nNeither needs a key.\n\n### Can an agent call AgentGate and ShieldGemma without installing anything?\n\nAgentGate runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for ShieldGemma.\n\n### Are AgentGate and ShieldGemma open source?\n\nAgentGate is open source (MIT). No open-source release is listed for ShieldGemma.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"agentgate\", \"b\": \"shieldgemma\"}`. From a terminal: `anchor compare agentgate shieldgemma`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/agentgate.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n\n## Other comparisons with AgentGate or ShieldGemma\n\n- [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md)\n- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)\n- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)\n- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)\n- [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md)\n- [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md)\n- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)\n- [Llama Guard 4 vs ShieldGemma](https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md)\n- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)\n- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)\n- [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md)\n- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)\n- [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md)\n- [AgentGate vs Amazon Bedrock Guardrails](https://www.anchorterminal.com/compare/agentgate-vs-amazon-bedrock-guardrails.md)\n- [AgentGate vs Azure AI Content Safety (Prompt Shields)](https://www.anchorterminal.com/compare/agentgate-vs-azure-ai-content-safety.md)\n- [AgentGate vs Cisco AI Defense Inspection API](https://www.anchorterminal.com/compare/agentgate-vs-cisco-ai-defense-inspection.md)\n- [AgentGate vs Google Cloud Model Armor](https://www.anchorterminal.com/compare/agentgate-vs-google-model-armor.md)\n- [AgentGate vs Granite Guardian](https://www.anchorterminal.com/compare/agentgate-vs-granite-guardian.md)\n- [AgentGate vs Guardrails AI](https://www.anchorterminal.com/compare/agentgate-vs-guardrails-ai.md)\n- [AgentGate vs Lakera Guard (Check Point AI Guardrails)](https://www.anchorterminal.com/compare/agentgate-vs-lakera-guard.md)\n- [AgentGate vs Llama Guard 4](https://www.anchorterminal.com/compare/agentgate-vs-llama-guard.md)\n- [AgentGate vs LlamaFirewall](https://www.anchorterminal.com/compare/agentgate-vs-llamafirewall.md)\n- [AgentGate vs Mistral Moderation API](https://www.anchorterminal.com/compare/agentgate-vs-mistral-moderation.md)\n- [AgentGate vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/agentgate-vs-nemo-guardrails.md)\n- [AgentGate vs OpenAI Guardrails](https://www.anchorterminal.com/compare/agentgate-vs-openai-guardrails.md)\n- [AgentGate vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/agentgate-vs-prisma-airs.md)\n- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)\n- [AgentGate vs Presidio](https://www.anchorterminal.com/compare/agentgate-vs-microsoft-presidio.md)\n- [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AgentGate vs ShieldGemma", "url": "" } ], "description": "ShieldGemma scores 54 (C) to AgentGate's 47.6 (D) for policy enforcement. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AgentGate D 47.6", "ShieldGemma C 54", "scores" ], "h1": "AgentGate vs ShieldGemma", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/agentgate-vs-shieldgemma", "published": "2026-10-01", "section": "tools", "title": "AgentGate vs ShieldGemma for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma" }, "tokens": { "markdown": 5350, "slim": 3230 }, "version": 1 }