Future AGI

Future AGI is an open-source platform for evaluating, tracing, and guardrailing LLM and AI-agent applications. The vendor frames it as one feedback loop: simulate, evaluate, protect, observe, optimize.

Future AGI landed on my desk as a vendor submission, and I gave it the same treatment as everything else in the catalog. What earned it a page is the Protect layer: an intercept-and-block guardrail engine shipped as open source , not a scoring dashboard.

Future AGI’s flagship platform repository was created in April 2026 and its README still opens with a nightly-release warning. This is early-stage software.

I list Future AGI in AI security on the strength of the guardrail layer, but the honest label is an evaluation and observability platform that happens to carry a credible security pillar.

What is Future AGI?

Future AGI is an Apache-2.0 platform that tests, evaluates, guardrails, and monitors LLM and AI-agent applications from one codebase.

Future AGI’s core is not a thin SDK. The repository ships a Django backend, a React frontend, and a Go gateway, and the documented self-host profile brings up 21 services through Docker Compose.

Future AGI organizes the product into six pillars that feed each other. Simulate generates multi-turn text and voice test conversations, and Evaluate scores the outputs.

Protect blocks unsafe traffic at runtime, Observe traces requests, and Optimize tunes prompts and agent workflows.

The Command Center is the sixth piece, an OpenAI-compatible gateway written in Go. The guardrails execute there, which matters more than the marketing taxonomy.

The company was founded in 2024 by Nikhil Pareek and Charu Gupta. It is headquartered in Mountain View with an R&D centre in Bangalore, and raised a $1.6M pre-seed in February 2025.

What are Future AGI’s key features?

The catalog below covers what the repository and public documentation support, not the full marketing feature grid.

Future AGI’s evaluators are inspectable rather than black-box scores, which is unusual in this category.

Is Future AGI open source?

The repository ships a plain Apache-2.0 LICENSE covering the platform. I reviewed the full 10,540-entry tree and found no ee/ directories and no LICENSE-EE file, which is supporting evidence rather than proof that every hosted component is Apache-2.0.

That may change. The frontend already ships an enterprise licence-key management screen for self-hosted customers, so the open-core plumbing exists even though no code sits behind it.

Treat the current Apache-2.0 coverage as a snapshot, not a permanent guarantee.

How does Future AGI’s Protect guardrail layer work?

Protect is the reason Future AGI sits in an AppSec catalog rather than an MLOps one. It is a pipeline that runs inside the gateway, not a report you read afterwards.

Requests pass through a pre-processing stage before they reach the model provider, and responses pass through a post-processing stage before they reach the user. Rules can be attached to either stage, or both.

The Go source settles whether “blocking” is literal. It is: the pipeline defines a block action that rejects the request with a 403 and short-circuits the remaining checks rather than continuing to score.

Future AGI’s 18 Protect modules split into recognizable AppSec territory. Injection handles prompt injection and jailbreak patterns with a tunable threshold. Secrets catches API keys and credentials in user messages.

Leakage watches for sensitive data flowing back out. mcpsec and toolperm check Model Context Protocol traffic and tool-call permissions, the excessive-agency surface that neither Giskard nor Guardrails AI covers at the gateway.

The rest handle content moderation, blocklists, custom expression rules, system-prompt protection, language and topic restriction, hallucination checks, input validation, and webhook dispatch.

Enforcement is per rule, which is the operationally useful part. You can start every rule in monitor mode, watch the false-positive rate on your own traffic, then promote individual rules to enforce once you trust them.

Where Protect is thinner than a dedicated AI-security tool: there is no model-file scanning, no training-data extraction testing, and no adversarial red-team campaign engine. The simulation pillar generates test conversations, not attacks.

Future AGI vs Giskard: which should you pick?

Giskard is the closest open-source comparison on this site, and the two solve different halves of the problem.

Giskard’s open-source library runs autonomous red-teaming agents that attack a model across 50+ adversarial probes, plus RAGET for generating RAG test cases from a knowledge base. Its centre of gravity is pre-deployment: find the failure before you ship.

Giskard does sell a runtime layer called Guards, a commercial detector tier for prompts, tools, and responses. The difference is where the blocking lives: Future AGI ships its enforcement gateway inside the Apache-2.0 core.

Maturity cuts the other way. Giskard has been public since 2022, carries roughly 5,700 GitHub stars, and names enterprises like AXA and BNP Paribas as users. Future AGI’s platform repo is three months old with 1,583 stars and no verifiable named customers.

The other structural difference is shape. Giskard is a library you import into a test suite, so it needs no separate platform to operate — only CI compute, dependencies, and whatever models it calls. Future AGI is a platform: 21 services to run, or a cloud account.

Pick Giskard if you want to attack your model before launch without standing up a separate platform. Pick Future AGI if you need something in the request path at runtime and want evaluation plus tracing in the same stack.

Future AGI vs Guardrails AI: which should you pick?

Guardrails AI is the direct comparison on the guardrail axis, and it is the more established of the two.

Guardrails AI is an Apache-2.0 Python framework built around composable validators. The Guardrails Hub carries a large library of them (toxicity, PII anonymization, hallucination detection, bias, profanity) and you compose several into a guard. It has roughly 7,200 GitHub stars.

Future AGI takes the opposite architectural bet. Instead of a library you wrap around every LLM call in application code, the guardrails live in an OpenAI-compatible gateway that all traffic already flows through.

That distinction has real consequences. The Guardrails AI model gives you per-call precision and no new infrastructure; the Future AGI model gives you central policy that applies to services you did not instrument, at the cost of running a gateway.

Coverage differs too. Guardrails AI is deeper on the validator catalog and community contributions. Future AGI is broader on the surrounding platform: tracing, evaluation, and simulation ship alongside the guardrails rather than being someone else’s tool.

Pick Guardrails AI if you want a mature, well-adopted validator library and prefer keeping guards inside your application code. Pick Future AGI if you want one enforcement point in front of every model call and value the surrounding observability more than validator breadth.

How much does Future AGI cost?

Future AGI publishes its pricing, so the numbers below come from the vendor’s public pricing page rather than a quote.

Self-hosting Future AGI’s Apache-2.0 core carries no licence cost. You still pay for your own infrastructure, for the model provider on bring-your-own-key evaluations, and for any external guard services you enable.

Future AGI’s managed cloud starts at $0/month with no credit card. Billing then runs on six usage dimensions with a monthly free allowance on each.

Future AGI’s three add-on tiers sit on top, and they buy retention and governance rather than more usage. Boost is $250/month for 90-day retention, SOC 2 Type II, OAuth SSO, and audit logs.

Scale is $750/month and adds one-year retention, unlimited monitors, a HIPAA BAA, and SAML SSO with SCIM. Enterprise at $2,000/month is where ABAC, data masking, and custom retention live.

Free and pay-as-you-go both cap retention at 30 days.

Heuristic evaluators are always free. Bring-your-own-key LLM-as-judge evals also cost nothing on the platform; you pay the model provider directly.

Future AGI’s trust page lists SOC 2 Type II and ISO 27001 as certifications, with ISO 42001 in progress, and claims GDPR, CCPA, and HIPAA compliance. Those are vendor-published claims; the underlying reports are available on request, so ask for them during procurement.

What are Future AGI’s limitations?

Future AGI is a young project, and its gaps are the kind you would expect from one.

The platform repository still carries a nightly-release warning in its README as of August 2026, and it currently has 596 open issues. That is not a criticism of the engineering so much as a statement of where the project is.

Future AGI’s adoption is unproven. All 14 of the vendor’s case studies use anonymized descriptors such as “a Fortune 50 retailer”, with no named customers I can verify.

The four open-source Protect adapters on Hugging Face had download counts in the single digits as of August 2026.

Third parties do not categorize Future AGI as security software. G2 lists it under LLMOps, comparison content groups it with Arize, Langfuse, and Braintrust, and it does not appear in the OWASP GenAI Security Solutions Landscape.

The performance and accuracy figures in the vendor’s materials are self-published and self-benchmarked. They are not independently reproduced and are not restated here, so budget time for your own evaluation.

Operationally, self-hosting is not lightweight. Twenty-one services is a real deployment, and the gateway architecture means Protect only covers traffic you actually route through it.

Finally, the open-core question is open. Nothing is enterprise-licensed today, but the enterprise licence-key UI is already built, so a future release could move features behind it.

When should you use Future AGI?

Future AGI fits a specific team profile. It makes the most sense if you need runtime guardrails and evaluation in the same system, and you want both self-hostable.

That combination is rare. Most tools give you one half.

Future AGI fits well if you already route model calls through a gateway or are willing to introduce one. The enforcement model depends on that chokepoint, and teams calling providers directly from a dozen services will get partial coverage.

Data-residency constraints are another strong signal. The Apache-2.0 stack runs with the cloud API key blank, which suits regulated environments that cannot send traces to a vendor.

Future AGI is a poor fit if you need a hardened, battle-tested control on a critical production path today. Three months of public platform history and no named references is a hard sell to a risk committee.

Future AGI is also the wrong tool if your actual need is adversarial red teaming or model supply-chain scanning. Giskard and Promptfoo cover the former, and neither Future AGI’s simulation nor its guardrails do model-file inspection.

What are alternatives to Future AGI?

No single tool replaces the whole platform, so the alternatives split by which pillar you need. The full list lives on the AI security tools category page.

• Guardrails AI — Apache-2.0 Python validator framework with the Guardrails Hub library. The closest match if you only want the guardrail half and prefer application-level guards over a gateway.
• LLM Guard — open-source input and output scanner from Protect AI, focused narrowly on prompt injection, PII, and toxicity. Lighter to adopt than a platform, though the repository is now archived on GitHub.
• Giskard — open-source testing and red-teaming library for LLMs, RAG, and traditional ML. Pre-deployment rather than runtime.
• Lakera — commercial real-time guardrail API for prompt injection and data leakage, and one of the external adapters Future AGI itself supports. The managed option if you would rather not run infrastructure.
• Arize AI — AI observability platform with the open-source Phoenix tracing project. The stronger choice if tracing and drift monitoring are the priority.
• Galileo AI — commercial evaluation and observability platform. Closed SaaS, but considerably more mature than Future AGI on the evaluation side.

How do I get started with Future AGI?

There are two entry paths, and which one you pick depends on whether you are evaluating the product or the guardrails.

1. Try the cloud first. Sign up at app.futureagi.com for the $0 tier: no credit card, and the free allowances cover a real pilot. Choose the US or EU region up front, because it affects where your traces land.
2. Instrument tracing. Install the traceAI instrumentor for whichever framework you use, register a tracer provider, and confirm spans arrive in the dashboard before you add anything else.
3. Point traffic at the gateway. Swap your OpenAI-compatible base URL to the Command Center endpoint. Nothing is enforced yet, but every request is now inspectable.
4. Add guardrails in monitor mode. Build a policy from the rules you care about — injection, PII, secrets — with every rule set to monitor. Let it run against production-shaped traffic and read the false positives.
5. Promote to enforce selectively. Move individual rules to enforce once their false-positive rate is acceptable. Do this rule by rule, not policy-wide.

If you need the self-hosted path instead, clone the repository and follow the Docker Compose guide in the self-hosting docs . Check the hardware sizing page first, because 21 services is not a laptop deployment.

For where this sits among neighbouring categories, the AI security tools hub covers guardrails, red-teaming, and model supply-chain tooling side by side.

Frequently Asked Questions