09/28/2026
Prediction Guard is now part of the Docker Verified Publisher agentic program, and our kit, predictionguard/sbx-predictionguard, is live on Docker Hub.
Here's why that matters. Agent frameworks let you stand up an agent in an afternoon. The hard part is everything after that: proving which identity an agent acted under, giving it least agency, keeping model traffic and sensitive data inside your boundary, and producing an audit trail your security team will actually accept. That's where most prototypes stall.
The kit handles that with two gates of defense.
Gate one is the sandbox. Network egress is restricted to a single endpoint, and credentials never enter the VM. If an agent reaches for something it shouldn't, the blast radius stays contained.
Gate two is our self-hosted control plane. Every model call and MCP tool call passes through it, with auditable, deterministic controls applied to live agent behavior rather than after the fact.
What you get:
- MCP tool scoping per agent identity, a built-in MCP proxy, logging of every tool call, and configurable human-in-the-loop approvals
- Runtime controls for PII redaction, credential scrubbing, and injection detection, plus behavior controls for memory poisoning, runaway token use, and goal drift
- OpenAI, Anthropic, MCP, and agent SDK compatible endpoints, so LangGraph, Pydantic AI, CrewAI, OpenCode, and Claude Code work with zero refactoring
- Signed images, Docker Scout scanning, and the Docker Verified Publisher badge
It runs wherever you already run workloads: on premises, air-gapped, or in a private VPC. The controls map to NIST, AIUC-1, OWASP, ISO, and EU AI Act guidance.
One command to launch a governed agent sandbox. Links to the kit and a guided evaluation are in the comments.
Thanks to Docker, Inc. and Eli Aleyner for the partnership, and to Daniel Whitenack for leading the way.