Microsoft has open-sourced two new tools aimed at bringing AI safety checks much earlier into the agent development lifecycle.

The tools, called Rampart and Clarity, were announced this week as part of Microsoft’s broader push to operationalize safety engineering for agentic AI.

“We built these tools because we believe that AI safety has to become a continuous engineering discipline rather than a periodic checkpoint, and we think the best way to make that happen is to put practical, open tools in the hands of the people doing the building,” Microsoft’s AI red team founder Ram Shankar Siva Kumar said in a security blog post.

The announcement comes as AI agents evolve from chatbot-style assistants into systems with real operational privileges. According to Microsoft, these newer agents introduce risks that traditional application security workflows were not designed to handle, including prompt injection, unsafe tool use, privilege escalation, and unintended autonomous actions.

Both Rampart and Clarity are now available as open-source projects from Microsoft.

Rampart for repeated AI red teaming

Microsoft has positioned Rampart as the more operational of the two tools. The framework is designed to help developers transform red-team findings into repeatable tests that can run continuously during development and deployment pipelines.

Built on top of PyRIT, Microsoft’s open automation framework for red teaming generative AI systems, Rampart aims to allow teams to execute both adversarial and benign test scenarios against AI agents in a structured and automated way.

The idea is to move beyond one-off safety reviews and instead include continuous checks directly into CI/CD workflows. “Where PyRIT is optimized for black-box discovery by security researchers after the system is built, Rampart is built for engineers as the system is being built,” Kumar explained.

The framework promises the ability to surface issues relating to cross-prompt injection, unsafe data handling, insecure tool execution, and other agent-specific attack paths before applications reach production. Additionally, Rampart is programmed to let organizations convert AI red-team findings into repeatable automated tests, helping engineers continuously check for regressions as agents evolve.

Clarity to focus on assumptions in AI agents

While Rampart focuses on testing systems being built, Clarity is aimed earlier in the workflow before code starts getting written.

Microsoft’s description of Clarity is that of a tool meant to examine and validate the assumptions behind AI agent design decisions. That would presumably include evaluating how agents are expected to behave, what permissions they should have, how they interact with tools and external systems, and where trust boundaries exist.

“Clarity runs as a desktop app, a web UI, or embedded directly in a coding agent,” Kumar said. “It guides engineers through structured conversations covering problem clarification, solution exploration, failure analysis, and decision tracking.”

These conversations are written to the “.clarity-protocol/” directory in the repository as markdown files, which can be committed, reviewed in pull requests, and diffed like source code, he added. Microsoft has been building an open-source “agent governance” and safety stack over the past few months, making Rampart and Clarity part of a broader strategy rather than a standalone release. Last month, the company introduced the Agent Governance Toolkit, focused on routine controls, policy enforcement, and OWASP-aligned protections for AI agents.