GoPlusSecurity/agentguard

GoPlus AgentGuard – security guard for AI agents

What it is – A Node‑based command‑line tool (and plugin) that sits between an AI coding agent (Claude Code, OpenClaw, Hermes, Codex, etc.) and the host system. It watches every command, file write, network request, and skill/plugin that the agent tries to run, applying a set of static‑analysis and runtime rules to block or warn about dangerous actions.

Why it matters – Modern AI agents can be given full terminal access. A malicious skill or a prompt‑injection attack can silently steal secrets, drain crypto wallets, or wipe disks. AgentGuard adds a real‑time security layer that:

• Hooks into the agent’s execution pipeline and stops known destructive commands (e.g., rm -rf /, fork bombs, curl|bash).
• Prevents writes to credential locations such as .env and ~/.ssh.
• Detects exfiltration attempts to common web‑hook endpoints (Discord, Telegram, Slack).
• Tracks which skill initiated each action, so you can attribute abuse.
• Provides a daily “patrol” that audits the whole environment for tampering, secret leaks, open ports, suspicious cron jobs, and trust‑registry health.

How you get it – Install globally with npm and run the one‑time agentguard init which auto‑detects the supported agents and installs the appropriate hooks/plugins.

npm install -g @goplus/agentguard
agentguard init   # detects Claude, OpenClaw, Hermes, etc.

No cloud account is required for the local guard; optional cloud connectivity is available for threat‑intel feeds and centralized audit sync.

Key features (as described in the README)

Layer	What it does
Automatic Guard (hooks)	Real‑time blocking of destructive shell commands, writes to secret files, and known exfiltration URLs. Tracks skill provenance.
Deep Scan (skill)	On‑demand static analysis of a skill/plugin (24 detection rules). Looks for secrets, backdoors, obfuscation, prompt‑injection patterns, and Web3‑specific wallet attacks. Generates a trust‑registry entry with capability‑based permissions.
Daily Patrol (OpenClaw)	Scheduled job (default 03:00 UTC) that runs eight comprehensive checks: integrity, secret exposure, network exposure, cron‑job safety, file‑system changes, audit‑log analysis, config health, and trust‑registry health. Produces a concise PASS/WARN/FAIL report and logs to ~/.agentguard/audit.jsonl.
Health Checkup	One‑click HTML report with a “lobster” visual score, summarising code safety, trust hygiene, runtime defense, secret protection, Web3 shield, and configuration posture.
Protection Levels	strict (block everything risky), balanced (block dangerous, ask for risky – default), permissive (only block critical threats).
Cloud / Threat‑Intel (optional)	agentguard connect registers a local JWT, pulls advisory feeds, and can sync redacted audit logs to the GoPlus cloud.

Typical workflow

1. Install & initialise – npm i -g @goplus/agentguard && agentguard init.
2. Scan a new skill – agentguard scan ./my‑skill (or agentguard dsh-scan … for DSH plugins). The CLI returns a human‑readable or JSON risk report.
3. Evaluate a single action – pipe a JSON description of a tool call into agentguard protect to see if it would be blocked.
4. Run daily patrol – agentguard patrol run or set it up as a cron job with agentguard patrol setup.
5. Review reports – agentguard report for audit logs, agentguard checkup for the visual health page, or agentguard trust list to see which skills are currently trusted.

Supported agents / integrations

• Claude Code – native plugin via claude plugin add ….
• OpenClaw – registers as an OpenClaw plugin (registerOpenClawPlugin). Hooks into before_tool_call / after_tool_call events.
• Hermes, Codex, QClaw, DSH – each has a specific init flag (agentguard init --agent <name>) that installs the appropriate hook bundle.

Limitations / scope (as per the README)

• The deep‑scan rules are static; they cannot catch runtime‑only behaviours that are not reflected in the source code.
• Patrol functionality is tied to an OpenClaw environment; non‑OpenClaw users must run manual scans.
• Remote code execution detection relies on heuristics (e.g., npx, npm exec, curl|bash). Pin‑exact commits to reduce warnings.
• The tool does not require a cloud connection, but advanced threat‑intel and centralized audit features need an optional API key.
• Certain DSH‑specific features (runtime mode, owner attribution) are only available when the DSH runtime exposes the required contracts.

Bottom line – AgentGuard is a purpose‑built security layer for AI coding agents that gives developers an easy way to enforce least‑privilege execution, automatically scan new plugins, and keep a daily health check on the whole agent ecosystem. It is a genuine, actively maintained open‑source project aimed at the emerging risk surface of AI‑driven automation.