Plugins
A plugin is a hook plus an SDK: it binds one surface's native interception points (an agent framework's tool lifecycle, a gateway's request/response filters, a sandbox's exec chokepoint) to the OGR contract — emitting GuardEvents, enforcing Verdicts — with the SDK doing the wire work underneath. Install one and a real agent is guarded without writing code.
The four hook categories
| Category | Binds | Altitude | Examples |
|---|---|---|---|
| Agent hooks | a framework's tool/model lifecycle (pre/post tool, pre/post model) | invocation | Claude Code, Codex, Hermes, LangGraph, OpenClaw, opencode |
| Gateway hooks | an LLM proxy's request/response path, normalized across protocols | conversation | Higress WASM plugin, OpenAI/Anthropic gateway example |
| Sandbox hooks | the exec chokepoint where commands actually run | execution | srt and OpenShell backends (via the Hermes plugin) |
| eBPF | kernel-level process/file/network observation | execution (kernel sensor) | the OGR eBPF reference sensor |
Kernel-level integrations map their events to the same execution
observation point — same contract, unbypassable sensor.
Install matrix
| Surface | Package / install | Registry |
|---|---|---|
| Claude Code | /plugin install openguardrails@openguardrails | Claude Code marketplace (guide) |
| Codex | marketplace plugin | Claude Code/Codex marketplace |
| Hermes | pip install openguardrails-instrumentation-hermes | PyPI (srt guide, OpenShell guide) |
| LangGraph | pip install openguardrails-instrumentation-langgraph | PyPI |
| OpenClaw | npm i openguardrails-instrumentation-openclaw | npm |
| opencode | npm i openguardrails-instrumentation-opencode | npm |
| Gateway (OpenAI/Anthropic) | pip install openguardrails-gateway | PyPI |
| Higress | WASM plugin | repo |
| eBPF sensor | CO-RE kernel program + userspace PEP | repo |
Language libraries pull in their core SDK (openguardrails /
@openguardrails/core) automatically; self-contained marketplace plugins
bundle it and need no separate runtime install.
Browse the full gallery with screenshots and writeups on the showcase.
Guides
- Claude Code — a
PreToolUsehook denies risky tool calls (curl|bash, obfuscated exec, non-allowlisted egress, credential reads) before they run, even in bypass mode. - Hermes + srt (personal) — one laptop,
OS-level filesystem and network isolation from one
policy.json. - Hermes + OpenShell (team) — multi-tenant container isolation with a central OPA/Rego egress proxy.
No plugin for your stack? The pattern is four steps — instrument your agent.