Invariant Labs provides policy inspection and security protection capabilities for Agent call chains, helping teams identify unauthorized access and injection risks before going online.

InvariantLabs

Core parameters and statistics of Invariant Labs

Parameters	Description
Official positioning	Secure, reliable and robust products for AI agents
Core Product Line	Explorer / Guardrails / MCP Scan / Gateway
Full company name	Invariant Labs AG
Headquarters	Zurich, Switzerland (Josefstrasse 219, 8005 Zürich)
Founder/CEO	Marc Fischer
CTO	Luca Beurer-Kellner
Advisory Team	Martin Vechev (Professor, ETH Zürich), Florian Tramèr (Professor, ETH Zürich)
Academic background	ETH Zürich spin-off entrepreneurship, with teams from ETH, Cambridge, Stanford, and Google Brain
Open Source License	Apache-2.0 (Guardrails Core Library & Gateway)
GitHub Stars (Guardrails)	435
GitHub Stars (Gateway)	77
GitHub Stars (MCP-Scan)	Subject to real-time data from the official warehouse
Ecological Events	Acquired by Snyk in 2025 to accelerate Agentic AI security innovation
Core Release (MCP-Scan)	2025-04-11
Core Release (Guardrails)	Early 2025
Core Release (Gateway)	2025
Contact	[email protected]

A brief comment: The core value of Invariant is to move Agent risk management from "incident response" to "development and online access control", and achieve operational security governance through the three-in-one rule engine + call link observation + MCP supply chain scanning.

Publicity Verification: The value of a security platform does not lie in "demonstration of detection capabilities", but in the controllability of false positives, controllable false negatives, and executable blocking strategies. Invariant provides verifiability in all three dimensions through Guardrails' Python-like rules language and Explorer's trace playback, rather than just attack surface presentation. MCP-Scan’s open source strategy lowers the threshold for community verification, but enterprise-level false alarm rate data remains unpublished information.

User and market recognition of Invariant Labs

Market positioning: A dedicated protection layer in the Agent security track, located between the Agent orchestration layer and the LLM provider/MCP server. Unlike general API security gateways (such as Kong, AWS WAF), Invariant's rules engine natively understands the Tool Call Chain and can detect cross-step permission abuse and injection attacks.

Snyk Acquisition Signal: In 2025, Snyk announced the acquisition of Invariant Labs, integrating its Agentic AI security capabilities into Snyk’s developer security platform. This acquisition indicates two trends: first, the application security market is considering AI Agent security as the next wave of increment; second, Agent security is evolving from an independent entrepreneurial track to complementing the capabilities of existing security platforms. Snyk's layout in the developer security ecosystem (open source dependency scanning, container security IaC security) complements Invariant's Agent security capabilities, but the product integration roadmap after the acquisition has not yet been made public.

Academic and Community Credit: The core members of the team are from ETH Zürich’s SRI Lab (Secure, Reliable, and Intelligent Systems Lab) and have published many top conference papers in the field of AI security (ICML 2024, etc.). The Guardrails core library has received 435 stars on GitHub, which is an early community recognition in the Agent security track. As an open source security scanning tool, MCP-Scan has a first-mover advantage in the MCP ecosystem.

Verification prerequisites for enterprise procurement: Brand endorsement (Snyk acquisition + ETH academic background) has reference value, but it still needs to be verified by the organization's threat model and red team testing. The following four aspects must be measured before purchasing: the impact of false positive rate on business continuity, the delay of the policy engine under high concurrency, the increase in the attack surface covered by MCP scanning, and the matching of its own technology stack, as well as the product independence and roadmap commitment after being acquired by Snyk.

Invariant Labs’ Cost Advantage: An Independent Assessment of the Three-Tier Cost Structure

• C-side/Individual: Usually a free version is provided to experience the core functions, and high-frequency use requires a paid package subscription.
• API/Developer: Billed by call volume, suitable for development teams that can be flexibly integrated into their own systems.
• Enterprise/Privatization: Contact the business owner to obtain customized quotation and deployment plan. The specific price is subject to the official real-time pricing page.

Key Features of Invariant Labs

Explorer — Agent behavior observation and trajectory analysis

• Trace visualization: Record the complete trace of each Agent call, including the complete round-trip chain of User → LLM → ToolCall → ToolOutput → LLM, presented in the form of a timeline.
• Dataset Management: Organize trajectory data by project (Dataset), and support trajectory classification and retrieval of multiple Agent instances.
• Debug Playback: Perform step-level playback of historical trajectories to reproduce the Agent's decision-making context in each round for false positive analysis and policy tuning.
• Gateway integration: By modifying the base_url of the LLM client to point to the Invariant Gateway, trajectories can be automatically collected without invading the Agent code.

Guardrails — Context-aware policy protection engine

• Python-style rule language: Rules are code, using raise "alert information" if: (variable: type) conditional expression syntax, supporting standard library functions and custom detectors (Detectors). Example:

raise "Trying to send email after detecting prompt injection" if:
    (output: ToolOutput) -> (call2: ToolCall)
    output is tool:get_website
    prompt_injection(output.content, threshold=0.7)
    call2 is tool:send_email

• Tool Call Chain Analysis: Natively supports cross-step pattern matching and can detect multi-step unauthorized behavior such as "first read the user's inbox and then send an email to an external mailbox".
• Standard Detector Library: Built-in detectors such as prompt_injection, secret_leak, tool_poisoning, and supports threshold customization.
• Dual-mode deployment: transparently enforce rules in LLM/MCP proxy mode via Gateway (zero code intrusion), or call LocalPolicy.analyze() directly in code via the invariant-ai Python package.

MCP Scan — MCP server security scan (open source)

• Tool Poisoning Detection: Scan the MCP server tool description for hidden malicious instructions and identify prompt injection.
• MCP Rug Pull Detection: Detect unauthorized changes to tool descriptions after user approval via Tool Pinning (tool description hash comparison).
• Cross-source upgrade detection: Detect tool shadowing attacks (Tool Shadowing) between different MCP servers to ensure tool command-level isolation.
• One-click scan: uvx mcp-scan@latest runs with zero configuration, automatically reads the local MCP configuration file and connects to the server to retrieve the tool description.
• Local + Cloud Dual Engine: Local rules perform basic security checks, and the cloud calls Invariant Guardrails API for in-depth analysis.

Gateway — LLM proxy and security middle layer (open source)

• Protocol compatible: Supports OpenAI Chat Completions API, Anthropic Messages API, Gemini API, LiteLLM, OpenAI Swarm, Microsoft Autogen.
• MCP Proxy: Supports three MCP transmission protocols: stdio, SSE, and Streamable HTTP, proxies all MCP calls and executes guard policies.
• Streaming Forwarding: Fully supports transparent transmission and detection of LLM streaming responses without damaging the client streaming experience.
• Docker one-click deployment: Provides official Docker image (ghcr.io/invariantlabs-ai/invariant-gateway/gateway:latest), supporting local and cloud bounded deployment.

Hidden linkage (expert perspective)

• Explorer ↔ Guardrails: Explorer provides trace evidence and Guardrails performs policy blocking. When Guardrails triggers a rule, the corresponding trajectory context automatically falls into Explorer, forming a "Detection → Blocking → Forensics → Tuning" context.
• MCP Scan ↔ Guardrails: The description of risk tools discovered by MCP Scan during the access phase can be directly converted into blocking rules in the Guardrails policy to achieve "scan once, continuous protection".
• Gateway ↔ Full range of products: Gateway is the central data pipeline for all products. After modifying the base_url of LLM and connecting to the Gateway, Explorer automatically collects trajectories and Guardrails automatically executes the policy, eliminating the need to integrate twice for observation and security.
• Snyk ecological integration prospects: After being acquired by Snyk, Invariant's MCP scanning capabilities may be merged with Snyk's existing open source dependency scanning (OSS) and container scanning IaC scanning into a unified "supply chain + runtime" security view, but this is still speculation.

Invariant Labs model and version evolution

Invariant focuses on iteration of product line capabilities, and the version number system has not yet been fully standardized. The following public milestones are traceable:

Mainline release

Time	Product Line	Event	Description
~2024 mid	Guardrails (core library)	Initial release	Productization of ETH Zürich research, base version of the rules engine
End of 2024	Explorer	Internal beta release	Agent trajectory observation platform, invitation required
2025-04-11	MCP-Scan	Public release	Open source MCP security scanning tool, supporting Tool Poisoning and Rug Pull detection
Early 2025	Gateway	Public release	Open source LLM/MCP proxy, zero-configuration integration with Explorer + Guardrails
Early 2025	Guardrails (Rules Language)	Major update	Introducing Python-like DSL, support for Detectors standard library
2025	Full product line	Snyk acquisition	Accelerate Agentic AI security innovation, follow-up roadmap to be disclosed
2025	Explorer	Gateway deep integration	Support automatic creation of Dataset through Gateway

Version information description

• The version number of Guardrails core library (invariant-ai PyPI package) is based on pyproject.toml, and the latest version is based on PyPI real-time data.
• The Gateway version number (currently 0.0.9) is marked in pyproject.toml, whichever is GitHub Release or PyPI.
• The release time of enterprise version features (multi-tenant policy management, audit log RBAC) is subject to the product roadmap after the Snyk acquisition.

Version management suggestions for the online team

1. Establish an independent Git repository for the Guardrails rule library and use CI/CD to perform rule regression testing.
2. Lock the major version numbers of invariant-ai and invariant-gateway to avoid production interruption caused by upstream API incompatibility.
3. After each policy update, use Explorer to play back the historical traces to verify any false positives/false negatives changes.
4. Pay attention to the Agent security vulnerability information in the Snyk Security Advisory and update the MCP-Scan rule base in a timely manner.

Invariant Labs’ technical advantages

Rule engine: Python-style DSL + Tool Call chain native analysis

Mechanism: Guardrails rule language is a superset (or strict subset) of Python. Each rule consists of three parts: "trigger conditions + pattern matching + expression constraints". Declarative bindings such as (msg: Message) and (output: ToolOutput) -> (call2: ToolCall) in the rules automatically map the event sequence in the Agent trajectory into a traversable variable space.

Effect: Compared with traditional regular expression or keyword blacklist solutions, Invariant can accurately identify cross-step compound attacks. For example, "first call get_website to obtain external content, and then execute the hidden malicious instructions through send_email", which cannot be discovered by single-step detection, but is clearly identifiable from the perspective of the Tool Call chain.

Applicable scenarios: High security scenarios that require multi-step call chain auditing (financial transaction review, medical data access control, cross-authority operations of internal enterprise systems).

Gateway Proxy Mode: Zero Intrusion Integration

Mechanism: Gateway acts as an intermediate layer between the LLM client and the LLM provider, and can be accessed by modifying base_url. When all LLM requests pass through the Gateway, they are automatically copied as traces and pushed to Explorer, while performing the "pre-check (before the request reaches LLM)" and "post-check (after LLM returns)" of the Guardrails policy.

Effect: No need to modify the Agent framework code, no need to introduce new SDK or dependencies. Taking OpenAI as an example, you only need to pass in the two parameters http_client and base_url in the OpenAI() constructor, and the existing Agent system can obtain complete observation and security capabilities.

Applicable scenarios: Teams that already have production-level Agents but lack security observations; heterogeneous environments where multiple LLM providers are mixed.

MCP security first: supply chain protection front-end

Mechanism: MCP-Scan performs a security scan before accessing the MCP server, and identifies risks by analyzing the semantic features (prompt injection mode, hidden instruction embedding, tool shadow reference) in the tool description text. The Tool Pinning function records the hash value of the tool description and detects changes during subsequent runs.

Effect: Move MCP supply chain security from "running state passive defense" to "access state active screening". Combined with Tool Pinning's continuous verification capability, it can detect "backdoor addition" attacks during the operation of the MCP server.

Applicable scenarios: Agent applications that use third-party MCP servers (such as Claude Desktop MCP Market Cursor MCP integration, self-built MCP proxy gateway).

Architecture link

Agent application
    |
    v
+------------------------------------------------+
| Invariant Gateway |
| (Modify base_url access, zero code intrusion) |
| |
| +---------------------+ +-----------------------+ |
| | Explorer | | Guardrails | |
| | Trajectory Collection | | Policy Execution Engine | |
| +---------------------+ +-----------------------+ |
| |
| +----------------------------------+ |
| | MCP Proxy (stdio/SSE/HTTP) | |
| +----------------------------------+ |

+------------------------------------------------+
    | |
    v v
LLM Provider MCP Server
(OpenAI/Anthropic/ (Third Party/Self-built)
 Gemini/LiteLLM) |
                           v
                     MCP-Scan (scan before access)
                     Tool Pinning (runtime verification)

Control flow direction: User request → Gateway → Guardrails pre-check → LLM/MCP call → Guardrails post-check → Response return → Explorer track placement. Data return direction: Gateway pushes traces to Explorer in real time. When a rule is hit, Guardrails automatically associates the evidence context to the corresponding trace.

Engineering Pitfall Guide

Pitfall 1: Deadly loop and Token inflation control The Guardrails rule engine will block the call by default when a violation is detected, but if the rule itself has a recursive match (for example, the rule matches both the input and output of ToolCall, forming an infinite trigger), it will cause the Gateway to execute the rule repeatedly. Solution: Set max_steps or step budget limit, add max_iterations parameter to each rule (if applicable), and monitor rule execution times exceptions in Explorer.

Pitfall 2: DOM/Exception context overload When Gateway proxies MCP calls, if the MCP server returns an overly long tool description (such as a tool description that includes a complete API document), it may cause the context window of the rule engine to overflow. Solution: Set the maximum length truncation (such as 4096 tokens) described by the tool at the Gateway layer, and automatically summarize the excess parts before sending them to the rule engine; or configure the Explorer to return only the accessibility tree level summary.

Pitfall 3: Security and ultra vires governance Once Guardrails rules are written incorrectly (for example, the regex is too broad), normal business requests may be blocked by mistake, causing production accidents. Solution: Set a confirmation point (Confirmation Gate) for the rules related to irreversible operations (delete, payment, release, transfer). By default, dry-run mode is enabled to run for a week to collect false positive data. After confirmation, switch to blocking mode. Gateway supports read-only mode at Dataset granularity. It is recommended that new rules be run in production bypass (shadow mode) first.

How to use Invariant Labs: four access paths

Path 1: Individual Developer - Local Rules Experiment

# Install invariant-ai package
pip install invariant-ai

#Write the rule file policy.gr
cat > policy.gr << 'EOF'
raise "Disable sending external emails after reading the inbox" if:
    (call: ToolCall) -> (call2: ToolCall)
    call is tool:get_inbox
    call2 is tool:send_email({
        to: ".*@[^company.com$].*"
    })
EOF

# Perform rule analysis in Python code
python3 -c "
from invariant.analyzer import LocalPolicy
policy = LocalPolicy.from_file('policy.gr')
result = policy.analyze(messages)
print(result.errors)
"

Path 2: Team - Gateway access (taking OpenAI as an example)

from httpx import Client
from openai import OpenAI

client = OpenAI(
    http_client=Client(
        headers={
            "Invariant-Authorization": "Bearer <YOUR_INVARIANT_API_KEY>"
        },
    ),
    base_url="https://explorer.invariantlabs.ai/api/v1/gateway/<dataset-name>/openai",
)
# All subsequent chat.completions.create calls will automatically collect traces + execute guard strategies

Path Three: Security Team—MCP Supply Chain Scan

# Scan local configured MCP servers with one click
uvx mcp-scan@latest

# View detailed tool description
uvx mcp-scan@latest inspect

# Scan the specified MCP configuration file
uvx mcp-scan@latest --config ~/.cursor/mcp.json

Path 4: Enterprise - Gateway local deployment

# Docker deployment
docker pull --platform linux/amd64 ghcr.io/invariantlabs-ai/invariant-gateway/gateway:latest
docker run -p 8005:8005 -e PORT=8005 --platform linux/amd64 \
  ghcr.io/invariantlabs-ai/invariant-gateway/gateway:latest

# Gateway will run at http://localhost:8005/api/v1/gateway/

Recommended acceptance indicators

Metrics	Description	Recommended thresholds
High-risk request blocking rate	Proportion of high-risk requests hit by Guardrails rules that are correctly blocked	>= 99% (regression tested)
False positive rate	The proportion of normal requests that are misjudged as high risk	< 1% (needs to be tuned according to business scenarios)
Increased latency (P99)	Additional latency introduced by Gateway	< 200ms (depending on rule complexity)
Security incident reduction rate	Proportional reduction rate of Agent security incidents after access	Target >= 50% (requires long-term observation)
MCP scan coverage	Ratio of scanned MCP servers to all connected MCP servers	100%

Invariant Labs Product Pricing

The pricing model is subject to the official real-time page. Usually a freemium or subscription system is used, and basic functions can be used for free. Advanced functions or high-frequency use require paid subscriptions, and users are advised to evaluate the optimal solution based on actual usage.

Application scenarios of Invariant Labs

Scenario 1: Compliance Agent security access control in the financial industry

Task type: The bank customer service agent needs to access multiple internal systems such as customer account information, transaction records, financial product recommendations, etc., and cross-authority operations are strictly prohibited (for example, the customer service agent cannot initiate transfers).

Invariant solution: Write the "Prohibit calling transfer tools after reading account information" rule through Guardrails, Gateway intercepts all LLM calls to the tool, and Explorer records each access trace for compliance auditing.

Benefits: Change compliance inspection from "post-audit random inspection" to "real-time automatic blocking" to reduce the risk of compliance violations. Deduction: The original manual audit coverage is 5-10%, and after access, it can reach 100% automatic access control.

Scenario 2: Security access control of MCP ecological applications

Task type: Enterprises connect multiple third-party MCP servers (such as GitHub MCP, Slack MCP, database MCP) to platforms such as Claude Desktop and Cursor. They need to ensure that there are no hidden malicious instructions in the descriptions of these tools.

Invariant solution: Integrate mcp-scan in the CI/CD pipeline, and automatically perform a security scan before each new MCP server is connected; after passing the scan, the tool description hash will be recorded in the Tool Pinning whitelist, and it will be continuously verified during runtime.

Benefits: Prevent two types of supply chain attacks: MCP Rug Pull (tool description is tampered with and backdoored) and Tool Poisoning (hidden prompt injection). Deduction: Security scanning reduced from hours of manual work to 1-3 minutes with one click.

Scenario 3: Governance of ultra vires operations within the enterprise’s internal automated processes

Task Type: Enterprises use multi-Agent frameworks such as AutoGen and CrewAI to perform cross-department automation tasks (such as the employee onboarding process of the HR system and the permission approval of the IT system), and need to prevent permission cross-border in Agent chain calls.

Invariant solution: Gateway is connected in proxy mode, Guardrails rules detect "whether the sensitive interface of system B is called beyond the authority after calling system A", and Explorer records the full link trace for post-event auditing.

Benefits: The authority boundary of the Agent automation process changes from "code review" to "runtime policy execution", reducing override accidents caused by Agent hallucinations.

Scenario 4 (restricted scenario): high-security isolation environment

Not applicable: Invariant's Explorer cloud service is not available in a completely offline air-gapped environment. At this time, only the local mode (LocalPolicy) of the Guardrails core library and the local Docker deployment of the Gateway can be used, but the trajectory visualization and remote collaboration capabilities of Explorer will be lost. If an organization's security policy prohibits any external API calls (including Invariant's Guardrails API), MCP-Scan's cloud analytics capabilities will also be unavailable.

Who is Invariant Labs suitable for?

• AI Security Engineer: Responsible for writing and maintaining Guardrails policy rules, analyzing security events in Explorer traces, and tuning the false positive/false negative balance. Prerequisites: Understand the Tool Call chain attack mode and be familiar with Python-style DSL.
• Agent application developer: Integrate the Gateway in the Agent code, configure the base_url and authentication header of the LLM client to ensure that the security layer does not destroy the Agent function. Prerequisite: Familiar with the client configuration of the Agent framework used (OpenAI SDK, Anthropic SDK, AutoGen, CrewAI, etc.).
• Security Compliance/Audit Staff: Verify Agent behavior compliance through audit logs exported by Explorer and regularly review Guardrails policy coverage. Prerequisites: Familiar with industry compliance standards (SOC2, HIPAA, PCI-DSS, etc.) requirements for AI systems.
• DevSecOps Engineer: Integrate MCP-Scan in CI/CD pipeline, manage Tool Pinning whitelist, maintain versioning of security baselines. Prerequisites: Familiarity with CI/CD toolchains (GitHub Actions, GitLab CI, etc.) and Docker deployment.
• Technology Buyer: Evaluate the cost of integrating Invariant with existing security technology stacks (SIEM, SOAR, API Gateway) versus the coverage of competing solutions (e.g. Guardrails AI, Rebuff, LLM Guard). Prerequisite: Understand the threat model of Agent production context.

Not applicable to the crowd:

• A purely experimental demo project (no real user data, no production traffic), the ROI of security investment is not obvious.
• A simple Chatbot without Tool Call (only text conversation, no external tools called), Invariant's core capability (Tool Call chain analysis) cannot be of value.
• Teams that have used Snyk's existing security platform and have minimal Agent calls: need to evaluate the product integration progress after Snyk's acquisition to avoid two integrations in the short term.
• Organizations that are completely offline air-gapped and do not allow any external API communication (see scenario four restrictions).

Invariant Labs Summary and Outlook

Core Competencies: Invariant's differentiation in the Agent security track lies in three points - 1) The rule engine natively understands the Tool Call chain and can detect multi-step compound attacks; 2) The Gateway agent mode realizes zero-intrusion integration, and you can obtain complete observation + security capabilities by changing the base_url of the LLM client; 3) MCP supply chain security pre-scanning (MCP-Scan) + runtime verification (Tool Pinning) form a combination.

Current Limitations and Uncertainties:

• The product roadmap after being acquired by Snyk has not yet been made public, and enterprises need to confirm the independent support cycle before purchasing.
• The service level agreement (SLA) and availability commitment of the Explorer cloud service are not disclosed, and key production environments need to evaluate the maturity of the local deployment solution.
• There is a lack of public benchmarks on the performance of the Guardrails rules engine when handling very complex rules (50+ nested conditions).
• The detection accuracy of multi-language Agent calls (Chinese, Japanese and other non-English prompts) has not been independently evaluated.
• MCP-Scan's cloud analysis involves tool description data transmission, and data residency terms need to be verified one by one.
• There are no public third-party security audit reports (such as SOC2 Type II, ISO 27001), and enterprise compliance procurement needs to be obtained from the sales team.

Follow-up observation points:

1. Snyk Integration Progress: 2025-2026 How Snyk integrates the Invariant product line into the existing platform (whether operated as a separate brand or merged into the Snyk Agent Security module) directly affects purchasing decisions.
2. False Positive Rate Community Benchmark: As the user base grows, the false positive/false negative reports accumulated by the community will become an important indicator for evaluating the maturity of the rule engine.
3. MCP ecological security standard evolution: If the security mechanism of the MCP protocol itself is enhanced (such as protocol-level authentication, tool permission declaration), it will affect the incremental value of Invariant supply chain security.
4. Changes in the competitive product landscape: If major cloud vendors (AWS, Azure, GCP) launch native Agent security services, the market space for independent security tools will be squeezed.

Procurement and Adoption Risk Assessment: For enterprise teams planning to deploy Agents in production environments, Invariant is an option worthy of PoC verification, especially in high-compliance industries and heavy users of the MCP ecosystem. It is recommended to start with the open source version of Guardrails + Gateway, complete the false positive rate and performance acceptance in a 2-4 week cycle, and then bind the enterprise version purchasing decision to the product roadmap schedule after the Snyk acquisition to avoid paying excessive migration costs during the platform integration transition period.

Related tools: GitHub Copilot, Cursor

Invariant Labs How to use

• Web client: You can use it by visiting the official website and registering an account. Most functions do not require installation.
• API access: Provides RESTful API, developers can obtain the API Key and integrate it into their own applications.

Version Info

• Invariant 0.8 ：Continuously optimize stability and developer experience. Specific capabilities are subject to official real-time release. （2026-06-11）
• first public release ：The early version information has not been fully disclosed. It is recommended to refer to the official update log. （未公开）