Guard
Check every tool call before it runs. Blocks droppers, exfiltration and leaked secrets, and asks before risky actions. Runs offline.
Plain Markdown for agents: /docs/guard.md
Guard sits between your agent and its tools. Each call is checked on your machine before it runs. The tool input never leaves your machine. A registered agent reports only the text of each deny or ask (for example "matches a reverse shell") so its owner sees it on the owner page and gets an email for a deny. Set report: false in guard.yaml to stop that.
| Decision | When |
|---|---|
| deny | A dropper, a decoded payload, a reverse shell, a known exfiltration host, a secret leaving the machine |
| ask | A script piped to a shell, a destructive command, an edit to a startup or agent-config file, a BCC on an email |
| allow | Everything else. Your agent's own permissions still apply |
Before a shell command installs or runs a package or skill (npm install, npx, pip install, clawhub install, npx skills add), Guard looks it up in the Verdict Registry. malicious is denied and caution needs approval. This is the only check that goes online. If the registry cannot be reached within 2 seconds, Guard lets the command through.
Install
Claude Code:
npm install -g securemyagent
securemyagent guard install
This adds one PreToolUse hook to ~/.claude/settings.json and keeps the old file as settings.json.sma-backup. Restart Claude Code.
Any MCP client: put Guard in front of a local server's command.
securemyagent guard --name <server> -- <server command and args>
The proxy cannot ask a human, so it refuses calls that would need approval.
OpenClaw: the securemyagent package is also the OpenClaw plugin. Install it with openclaw plugins install npm:securemyagent (plugin id securemyagent-guard).
Fast mode
Each hook call normally starts Node, which takes about 60 ms. Fast mode keeps a small resident helper running and answers in about 9 ms:
securemyagent guard install --fast
The hook command talks to the helper over a private unix socket (~/.securemyagent/guard.sock, owner only) using perl, which macOS and most Linux systems have. If the helper is not running or does not answer, the hook runs the normal securemyagent guard hook, which also starts the helper again, so a call is never left unchecked. The helper makes the same decisions as the normal hook, exits after four idle hours, and stops with securemyagent guard daemon stop. securemyagent guard install switches back to the normal hook.
Policy
Guard reads ~/.securemyagent/guard.yaml. Without the file it uses the standard preset.
preset: standard # relaxed | standard | locked
egress:
allow:
- api.github.com
- "*.anthropic.com"
| Preset | Effect |
|---|---|
relaxed | Denies only. Never asks |
standard | Denies and asks |
locked | Every ask becomes a deny. Network calls must go to a host on egress.allow |
With egress.allow set, a shell command or web fetch to any other host needs approval (standard) or is blocked (locked). *.example.com covers subdomains, not example.com itself.
Ask your owner (Pro)
By default an ask is a prompt in your terminal. If the agent is claimed, Guard can send it to its owner instead: the owner gets an email with a link, opens the owner page and taps Approve or Deny.
approvals:
owner: true
timeoutSeconds: 90 # 10 to 120
Approve lets the call run, Deny blocks it. If nobody answers in time, the agent is not claimed or the API cannot be reached, Guard falls back to the local ask. A command is sent only as a short description, and never when it contains a credential. Run securemyagent guard install again after upgrading so the hook may wait long enough (130 seconds).
If the file cannot be read, Guard warns and uses standard. The policy file applies to the Claude Code hook, the MCP proxy and the OpenClaw plugin (preset and egress.allow; the plugin re-reads it when it changes).
goose
securemyagent guard goose-install # every project: ~/.agents/plugins/securemyagent-guard
securemyagent guard goose-install --project . # one project
This writes a goose PreToolUse hook that runs securemyagent guard goose-hook. It blocks (exit code 2, reason on stderr) the same attacks as the Claude Code hook. It also blocks any tool input, shell command or file write that carries a private key or seed phrase, or reads a wallet environment variable such as PRIVATE_KEY. The block message tells the agent to sign through the Agent Secret Store tools stage_transaction and request_signature. The rule is set to on_failure: block. goose hooks cannot ask a human, so a confirm-level finding is left to goose's own permissions unless the policy preset is locked.