Runtime security for multi-agent AI.
Detect, intervene, and audit what your agents say to each other — before it causes damage.
Trusted by developers — integrated into high-star repositories
On the same Claude Pro plan. With InsAIts active, Opus sessions ran consistently longer — no manual switching to Sonnet required. Opus subagents stayed active the entire time.
Mechanism: early anomaly correction prevents token waste from compounding errors. Less wasted tokens per unit of actual work.
The blind spot
Microsoft, CrowdStrike and Cisco can see that an agent exists. They cannot see inside a spawn chain. When an agent spawns a subagent that spawns another subagent, the behavior of those deeper agents is completely invisible to every enterprise monitoring tool on the market today.
InsAIts is the only tool that tracks the full spawn tree at every depth, captures anomalies before execution at every level of the chain, and shows you exactly which agent spawned which.
The agents nobody watches are the agents that cause the most damage.
What it does
23 anomaly types across 10 detectors: hallucination chains, semantic drift, phantom citations, jargon drift, credential exposure, prompt injection, tool poisoning, behavioral fingerprint changes.
Quarantine critical messages, reroute to backup agents, escalate to human review. Circuit breaker auto-blocks agents with high anomaly rates. Not just alerting — actual blocking.
SHA-256 hash chain for every message. Regulatory compliance ready. Detects any log modification. Full forensic chain tracing from anomaly to root cause.
Real-time Threat Index, Blast Radius, Agent Intelligence Scores. Circuit breaker status grid. Anomaly distribution. OWASP CVE panel with verified signatures.
PreToolUse hook monitors every tool call before execution. Blocks dangerous actions. Writes real-time audit log. Merged into everything-claude-code as the default security hook.
Configure a behavioral anchor once. InsAIts automatically injects it at every new task — keeping the agent focused, honest, and deep. Zero user effort after setup. Hot-reloads from file.
One toggle makes interventions opaque to the monitored model. Prevents the agent from categorizing and dismissing warnings. Mitigates adversarial monitor transparency.
LangChain, CrewAI, LangGraph, Claude Code, Cursor, Windsurf, Codex CLI, Kiro, Continue.dev, Aider. Slack alerts. Notion and Airtable export. Prometheus metrics.
Zero data transmitted to cloud. GDPR and HIPAA ready out of the box. Audit logs store hashes only. Your agents' communications stay on your machine. Air-gapped deployments supported.
Quick start
from insa_its import insAItsMonitor
# One line setup — 100% local, no API key needed
monitor = insAItsMonitor()
# Monitor any AI-to-AI message
result = monitor.send_message(
text=agent_response,
sender_id="OrderBot",
receiver_id="InventoryBot",
llm_id="gpt-4o"
)
# Act on results
if result["monitor_result"].should_halt():
outcome = monitor.intervene(message, result["monitor_result"])Interactive
Real anomaly types from production sessions
Detection coverage
| Category | Anomaly | What It Catches | Severity |
|---|---|---|---|
| Hallucination | FACT_CONTRADICTION | Agent A vs Agent B disagree on facts | CRITICAL |
| PHANTOM_CITATION | Fabricated URLs, DOIs, arxiv IDs | HIGH | |
| UNGROUNDED_CLAIM | Response does not match source documents | MEDIUM | |
| CONFIDENCE_DECAY | Agent certainty erodes: "certain" → "maybe" | MEDIUM | |
| CONFIDENCE_FLIP_FLOP | Agent alternates between certain and uncertain | MEDIUM | |
| Semantic | SEMANTIC_DRIFT | Meaning shifts over conversation (EWMA + cosine) | HIGH |
| HALLUCINATION_CHAIN | Speculation promoted to "fact" across agent hops | CRITICAL | |
| JARGON_DRIFT | Undefined acronyms flooding the conversation | MEDIUM | |
| Data Integrity | UNCERTAINTY_PROPAGATION | "partial results" silently becomes "complete results" downstream | HIGH |
| QUERY_INTENT_DIVERGENCE | User asks "avg by region" but agent queries "sum by category" | MEDIUM | |
| Security (OWASP) | TOOL_DESCRIPTION_DIVERGENCE | Tool description changed between discovery and invocation (MCP03) | CRITICAL |
| BEHAVIORAL_FINGERPRINT_CHANGE | Agent behavior deviates from established baseline (rug pull) | HIGH | |
| CREDENTIAL_EXPOSURE | API keys, tokens, passwords leaked in agent messages (MCP01) | CRITICAL | |
| INFORMATION_FLOW_VIOLATION | Data flows between agents that violate policies (MCP06/MCP10) | HIGH | |
| TOOL_CALL_FREQUENCY_ANOMALY | Unusual spike or pattern in tool invocations (MCP09) | MEDIUM | |
| Communication | SHORTHAND_EMERGENCE | "Process order" becomes "PO" — unexplained shorthand | HIGH |
| CONTEXT_LOSS | Topic suddenly changes mid-conversation | HIGH | |
| CROSS_LLM_JARGON | Made-up acronyms between agents: "QXRT", "ZPMF" | HIGH | |
| ANCHOR_DRIFT | Response diverges from user's original question | HIGH | |
| Model | LLM_FINGERPRINT_MISMATCH | GPT-4 response looks like GPT-3.5 | MEDIUM |
| LOW_CONFIDENCE | Excessive hedging: "maybe", "perhaps", "I think" | MEDIUM | |
| Compliance | LINEAGE_DRIFT | Semantic divergence from parent message | MEDIUM |
| CHAIN_TAMPERING | Hash chain integrity violation — audit log was modified | CRITICAL |
Security standards
Simple pricing
All detection features are open source. Pay for productivity and team features.
Lifetime Access — 100 seats only
Pay once, use forever. Available for both Starter ($99) and Pro ($99) tiers. Once 100 seats are claimed, lifetime pricing is gone.
Questions? Email info@yuyai.pro
Industries
Order bots losing context mid-transaction. Pricing contradictions between agents.
Support agents developing incomprehensible shorthand. Jargon drift over sessions.
Analysis pipelines hallucinating metrics, contradicting numbers between agents.
Critical multi-agent systems where hallucination chains have real consequences.
Scientific integrity — catching fabricated citations and phantom papers.
AI-generated documents with phantom references and ungrounded claims.
Real sessions
From actual Claude Code Opus sessions monitored by InsAIts
v3.3.0 — Agent Intelligence Scores + Live Anomaly Feed
v3.1.4 — Subagent Tracking + Behavioral Fingerprint
Agent Intelligence Scores — 12 agents + subagents with parallel attribution
Claude Code Integration — VS Code split terminal with TUI dashboard