[Feature] ATR Threat Detection guardrail plugin — 108 rules, zero API keys, <1ms

Hi Portkey team,

We'd like to contribute an ATR (Agent Threat Rules) guardrail plugin. ATR provides 108 open-source detection rules for AI agent threats — same rules that Cisco AI Defense ships in production (https://github.com/cisco-ai-defense/skill-scanner/pull/79).

Why ATR is different from existing guardrails:

	ATR	CrowdStrike AIDR	Akto
Cost	Free (MIT)	Paid API	Paid
API key	None	Required	Required
Latency	<1ms (regex)	API roundtrip	API roundtrip
Offline	Yes	No	No
Rules	108 open-source	Proprietary	Proprietary

What it detects: Prompt injection, tool poisoning, credential exfiltration, skill supply chain attacks, agent manipulation, privilege escalation — 9 threat categories mapped to OWASP Agentic Top 10.

Tested on: 53,577 real-world MCP skills, 0% FP on clean content.

Questions before we submit a PR:

1. Should the plugin bundle rules as a static JSON constant (like default/regexMatch.ts) or fetch at runtime?
2. We noticed the plugin build system doesn't support npm dependencies. Should we vendor the regex patterns inline?
3. Any preferred naming convention for the plugin directory and function IDs?

We already have a manifest.json and handler prototype following the patterns in plugins/default/regexMatch.ts and plugins/Contributing.md.

• Website: https://agentthreatrule.org
• Rules: https://github.com/Agent-Threat-Rule/agent-threat-rules
• Cisco integration: https://github.com/cisco-ai-defense/skill-scanner/pull/79