How-to: Protect LangChain agents with langchain-agent-memory-guard (5 minutes)

[vgudur-dev]

Why

Persistent agent memory / tool outputs are an ASI06 attack surface. OWASP Agent Memory Guard ships a LangChain middleware package so you can wrap an agent without rewriting your memory store.

• Core: agent-memory-guard
• Wrapper: langchain-agent-memory-guard (PyPI 0.1.0)
• Clinic (core Policy.strict repro): https://gist.github.com/vgudur-dev/ead8817d2f4df08c04b808cc5b53eb06
• Integration folder: https://github.com/OWASP/www-project-agent-memory-guard/tree/main/integrations/langchain-agent-memory-guard

Install

pip install langchain-agent-memory-guard
# pulls agent-memory-guard>=0.2.2 and langchain>=0.3.0

Quick start (middleware)

from langchain.agents import create_agent
from langchain_agent_memory_guard import MemoryGuardMiddleware

agent = create_agent(
    "openai:gpt-4o",
    tools=[...],  # your tools
    middleware=[MemoryGuardMiddleware()],  # default: block on violation
)

result = agent.invoke({"messages": [("user", "Search for recent news")]})

Violation modes

MemoryGuardMiddleware(on_violation="block")  # default — raises
MemoryGuardMiddleware(on_violation="warn")   # log, continue
MemoryGuardMiddleware(on_violation="strip")  # remove violating content

Optional: Policy.strict()

from agent_memory_guard import Policy
from langchain_agent_memory_guard import MemoryGuardMiddleware

middleware = MemoryGuardMiddleware(policy=Policy.strict())

(Custom Policy / protected keys: see the integration README.)

What gets scanned

Hook	Scans	Threat
before_model	messages in state	injection in memory/context
after_model	model response	secret leakage / injection propagation
wrap_tool_call	tool output	injection via tools (primary vector)

Alternate path: GuardedChatMessageHistory

If you only need guarded chat history (not full middleware):

from agent_memory_guard import MemoryGuard, Policy
from agent_memory_guard.integrations import GuardedChatMessageHistory

history = GuardedChatMessageHistory(
    session_id="sess-1",
    guard=MemoryGuard(policy=Policy.strict()),
)

Try the clinic, then leave an Adopter note

1. Run the public clinic Gist (~15 min).
2. Open a GitHub issue titled Adopter: <name> — LangChain with stack versions + what was blocked/allowed.
3. Optional: comment here with feedback on the middleware API.

Non-claims

Not an OWASP certification. Not MITRE approval. Public Apache-2.0 project only.

---

[vgudur-dev]

Thanks for reading the LangChain how-to.

Where to start (vendor-neutral)

1. This Discussion (How-to: Protect LangChain agents with langchain-agent-memory-guard (5 minutes) #116) — 5-minute MemoryGuardMiddleware path
2. README — LangChain middleware section on the main project README (shipped via PR docs: LangChain clinic + how-to links on README (closes #115) #118 / closed GFI Docs: LangChain middleware quick-start on main README (link wrapper + clinic) #115)
3. Clinic Gist (Policy.strict repro, ~15 min): https://gist.github.com/vgudur-dev/ead8817d2f4df08c04b808cc5b53eb06
4. After a clinic run, optional public note: open an issue titled Adopter: <name> — <framework> with stack versions + what was blocked/allowed (see template pattern in Adopter: Moviw — agent-memory-guard #123). Consent boxes are yours to tick.

New docs GFI for the Framework-integrations pointer: #140

Live ops meters (SEPARATE series — as of 28 Sep 2026 ~09:09 AM PT)

Quote as two sentences. Do not add them together.

• PyPI downloads (pepy, CI on) for agent-memory-guard: 11,944 all-time. Wrapper langchain-agent-memory-guard: 1,167 all-time (separate package).
• Repository clones (public clone gist, not Insights): 12,755 clones / 3,857 uniques.

Letter-packet freeze remains counsel SoT 8,071 pepy / 11,051 clones until counsel updates — that freeze is independent of this ops refresh.

Non-claims

Not an OWASP certification. Not a MITRE endorsement. If you cite ATLAS, cite the AML.M0031 YAML listing only (do not say MITRE-approved). Public Apache-2.0 Incubator project.

Happy to answer middleware API questions here.