# Oso

Oso is a security option for building AI agents. Authorization-as-a-service — decide what this agent may touch, per record.

## Facts

- Layer: Security (What stops it)
- Vendor: Oso
- Licence: open source
- Pricing: freemium
- Self-hostable: yes
- SDKs: py, ts
- Job within the layer: authz
- Requires: `OSO_AUTH_API_KEY`
- Docs: https://www.osohq.com/
- Last verified: 2026-08-21

## When to reach for it

- You are choosing a security component — what stops it.
- You need to run it on your own infrastructure, or your procurement process requires source access.
- Within security, it does one specific job: authorization.

## Alternatives in the security layer

| Option | What it does | Licence | Self-host |
| --- | --- | --- | --- |
| Llama Guard | Open-weight classifier for input and output safety. Runs wherever you run it. | open source | yes |
| Guardrails AI | Declarative input/output validators with a hub of prebuilt checks. | open source | yes |
| NeMo Guardrails | NVIDIA's programmable rails — constrain topic, dialogue path and tool use. | open source | yes |
| Lakera Guard | Prompt-injection and jailbreak detection as a low-latency API call. | proprietary | no |
| Rebuff | Open-source prompt-injection detector with canary tokens. | open source | yes |
| Invariant | Policy engine and analyzer for agent traces and MCP tool calls. | open source | yes |
| Descope Agentic Identity | Identity, delegated consent and scoped tokens for agents acting on behalf of users. | proprietary | no |
| Auth0 for AI Agents | Token vault, async user approval and fine-grained authorization for tool calls. | proprietary | no |
| Microsoft Presidio | PII detection and redaction before text ever reaches a model provider. | open source | yes |
| Cloudflare AI Gateway | Rate limiting, caching, spend caps and logging in front of any provider. | proprietary | no |
| iron-proxy | Default-deny egress firewall for untrusted workloads. The sandbox holds worthless proxy tokens; real credentials are swapped in at the boundary. | open source | yes |
| gVisor | Google's user-space kernel. Intercepts syscalls before they reach the host, without paying for a full VM. | open source | yes |
| Firecracker | AWS microVMs — a separate Linux kernel per sandbox, booting in about 125ms. | open source | yes |
| Kata Containers | MicroVM isolation behind the ordinary container API — drops into Kubernetes as a RuntimeClass. | open source | yes |
| No isolation (host process) | The agent runs as an ordinary process on the host. Honest default only when it executes no code and reads nothing untrusted. | open source | yes |
| E2B | Firecracker sandboxes for running code the agent wrote, safely. | open source | yes |

Head to head:

- https://newagent.build/compare/oso-vs-llama-guard
- https://newagent.build/compare/oso-vs-guardrails-ai
- https://newagent.build/compare/oso-vs-nemo-guardrails
- https://newagent.build/compare/oso-vs-lakera
- https://newagent.build/compare/oso-vs-rebuff
- https://newagent.build/compare/oso-vs-invariant
- https://newagent.build/compare/oso-vs-descope-agentic
- https://newagent.build/compare/oso-vs-auth0-ai

## Add it to a stack

```bash
curl -fsSL "https://newagent.build/api/stack?security=oso&format=sh" | sh
```

## Machine interfaces

- `GET https://newagent.build/api/registry` — every component as JSON
- `GET https://newagent.build/api/vendors` — vendors, with the repo and releases feed to watch
- `GET https://newagent.build/api/advise?q=<plain english>` — recommended stack for a description
- `GET https://newagent.build/api/stack?<layer>=<id>&format=sh|json|md|yml|agents|env` — a stack as files
- `GET https://newagent.build/llms.txt` — the whole registry in one fetch

Any page here also returns markdown if you send `Accept: text/markdown`.