AgentGuard
Local agent action control · proof in progress

Put policy before
an agent action.

AgentGuard is building a private, last-mile policy boundary for consequential agent actions. The current packages provide policy evaluation and compatibility telemetry; executor-owned firewall proof remains pending.

Read the named-action proofDiscuss a technical evaluation
$ npm install @the-bot-club/agentguard$ pip install agentguard-tech
Current artifacts:typescript sdkpython compatibility sdkopenclaw hookmcp http adaptermcp in-process adapterlocal v1 contractsexpress apicli sourceself-hosting references
Why AgentGuard

A narrow control boundary, stated plainly.

AgentGuard separates what exists today from the stronger proof the project is still working to earn.

/01

Local policy contracts

The TypeScript line contains strict v1 contracts for requests, decisions, permits, outcomes, and evidence. They are independently versioned from the Python compatibility package.

/02

Compatibility is not a firewall

The shipped OpenClaw hook and MCP HTTP/in-process adapters can observe policy decisions and return a block result. They can also be disabled or bypassed, so they are telemetry, not capability separation.

/03

Proof before stronger claims

A same-UID configured intercept exists for one GitHub file write. Capability isolation and firewall results are not claimed. See the named-action proof.

How it works

Four facts you can verify in the source.

step 01

Choose a package

The TypeScript and Python packages have independent release lines and different assurance scope.

pip install agentguard-tech
step 02

Evaluate a proposal

The compatibility SDKs can send a proposed action to the policy API and return its decision.

from agentguard import guard

@guard(policy="local-policy")
def run_agent(...): ...
step 03

Keep deferred states blocked

V1 can allow or block. A require-approval decision blocks dispatch; human approval is deferred.

limits:
  daily_spend_aud: 500
  tools_allow:
    - search
    - read_file
require_approval:
  - send_email
step 04

Read the limitations

The repository documents which adapters are compatibility-only and which broker proof is still missing.

github.com/thebotclub/agentguard-core
OpenClaw · compatibility path

Observe hook events. Keep the limit visible.

The current TypeScript package includes a structural OpenClaw before_tool_call HTTP hook. It can return a block result, but it does not own the raw tool capability and is not firewall proof.

  • Current artifact: TypeScript compatibility hook.
  • Strict mode can return a block when evaluation fails.
  • Permissive mode allows on evaluation error.
  • Executor-owned MCP-stdio broker proof is pending.
~/fleet/openclaw.config.yaml
{
  "plugins": {
    "entries": {
      "agentguard": {
        "enabled": true,
        "config": {
          "apiKey": "${AGENTGUARD_API_KEY}",
          "agentId": "my-agent",
          "strict": true
        }
      }
    },
    "installs": {
      "agentguard": {
        "source": "npm",
        "spec": "@the-bot-club/agentguard@0.11.2"
      }
    }
  }
}
Independent projects

One event spec. One policy DSL. One audit log.

AgentGuard and Tribunal are separate projects with separate release lines. AgentGuard currently focuses on policy contracts and compatibility paths for runtime actions; the shared branding does not imply shared proof or complete agent coverage.

tribunal.dev →Read the assurance limits →
Availability

Packages are public. Paid terms are not.

Read availability status →

TypeScript

0.11.2 / TypeScript
  • Published package manifest
  • Canonical local v1 contracts
  • OpenClaw compatibility hook
  • BSL 1.1 source licence

Python

0.11.2 / Python
  • Independent compatibility release
  • HTTP policy evaluation
  • No TypeScript v1 parity claim
  • BSL 1.1 source licence
  • Published package manifest

Firewall proof

Pending / topology gate
  • Executor-owned broker required
  • Raw capability held outside OpenClaw
  • Topology evidence not yet complete
  • No production assurance claim
  • Failure probes are planned
  • Host-compromise limits stay explicit

No public prices, paid tiers, retention promises, or SLA are offered. Read why →

Evaluate the narrow path on its evidence.

Discuss a technical evaluationInspect policy decisions