# Guard

Check every tool call before it runs. Blocks droppers, exfiltration and leaked secrets, and asks before risky actions. Runs offline.

Guard sits between your agent and its tools. Each call is checked on your machine before it runs. The tool input never leaves your machine. A registered agent reports only the text of each deny or ask (for example "matches a reverse shell") so its owner sees it on the owner page and gets an email for a deny. Set `report: false` in `guard.yaml` to stop that.

| Decision | When                                                                                                           |
| -------- | -------------------------------------------------------------------------------------------------------------- |
| deny     | A dropper, a decoded payload, a reverse shell, a known exfiltration host, a secret leaving the machine         |
| ask      | A script piped to a shell, a destructive command, an edit to a startup or agent-config file, a BCC on an email |
| allow    | Everything else. Your agent's own permissions still apply                                                      |

Before a shell command installs or runs a package or skill (`npm install`, `npx`, `pip install`, `clawhub install`, `npx skills add`), Guard looks it up in the [Verdict Registry](/docs/registry). `malicious` is denied and `caution` needs approval. This is the only check that goes online. If the registry cannot be reached within 2 seconds, Guard lets the command through.

## Install

Claude Code:

```bash
npm install -g securemyagent
securemyagent guard install
```

This adds one PreToolUse hook to `~/.claude/settings.json` and keeps the old file as `settings.json.sma-backup`. Restart Claude Code.

Any MCP client: put Guard in front of a local server's command.

```bash
securemyagent guard --name <server> -- <server command and args>
```

The proxy cannot ask a human, so it refuses calls that would need approval.

OpenClaw: the `securemyagent` package is also the OpenClaw plugin. Install it with `openclaw plugins install npm:securemyagent` (plugin id `securemyagent-guard`).

## Fast mode

Each hook call normally starts Node, which takes about 60 ms. Fast mode keeps a small resident helper running and answers in about 9 ms:

```bash
securemyagent guard install --fast
```

The hook command talks to the helper over a private unix socket (`~/.securemyagent/guard.sock`, owner only) using `perl`, which macOS and most Linux systems have. If the helper is not running or does not answer, the hook runs the normal `securemyagent guard hook`, which also starts the helper again, so a call is never left unchecked. The helper makes the same decisions as the normal hook, exits after four idle hours, and stops with `securemyagent guard daemon stop`. `securemyagent guard install` switches back to the normal hook.

## Policy

Guard reads `~/.securemyagent/guard.yaml`. Without the file it uses the `standard` preset.

```yaml
preset: standard # relaxed | standard | locked
egress:
  allow:
    - api.github.com
    - "*.anthropic.com"
```

| Preset     | Effect                                                                      |
| ---------- | --------------------------------------------------------------------------- |
| `relaxed`  | Denies only. Never asks                                                     |
| `standard` | Denies and asks                                                             |
| `locked`   | Every ask becomes a deny. Network calls must go to a host on `egress.allow` |

With `egress.allow` set, a shell command or web fetch to any other host needs approval (`standard`) or is blocked (`locked`). `*.example.com` covers subdomains, not `example.com` itself.

### Ask your owner (Pro)

By default an ask is a prompt in your terminal. If the agent is claimed, Guard can send it to its owner instead: the owner gets an email with a link, opens the owner page and taps Approve or Deny.

```yaml
approvals:
  owner: true
  timeoutSeconds: 90 # 10 to 120
```

Approve lets the call run, Deny blocks it. If nobody answers in time, the agent is not claimed or the API cannot be reached, Guard falls back to the local ask. A command is sent only as a short description, and never when it contains a credential. Run `securemyagent guard install` again after upgrading so the hook may wait long enough (130 seconds).

If the file cannot be read, Guard warns and uses `standard`. The policy file applies to the Claude Code hook, the MCP proxy and the OpenClaw plugin (`preset` and `egress.allow`; the plugin re-reads it when it changes).

## goose

```bash
securemyagent guard goose-install              # every project: ~/.agents/plugins/securemyagent-guard
securemyagent guard goose-install --project .  # one project
```

This writes a goose PreToolUse hook that runs `securemyagent guard goose-hook`. It blocks (exit code 2, reason on stderr) the same attacks as the Claude Code hook. It also blocks any tool input, shell command or file write that carries a private key or seed phrase, or reads a wallet environment variable such as `PRIVATE_KEY`. The block message tells the agent to sign through the Agent Secret Store tools `stage_transaction` and `request_signature`. The rule is set to `on_failure: block`. goose hooks cannot ask a human, so a confirm-level finding is left to goose's own permissions unless the policy preset is `locked`.