Plugins
A plugin is a hook that speaks the API directly: it binds one surface's native interception points to the OGR contract — forwarding raw provider bodies as GuardEvents, enforcing Verdicts — with the same two POSTs per model call your own agent would make (there is no SDK layer). Install one and a real agent is guarded without writing code.
Two integration points
| Category | Binds | Who fills the four-tuple |
|---|---|---|
| Agent-direct hooks | a harness's model-call lifecycle — the loop's own seams | the agent asserts its own identity |
| Gateway hooks | an LLM proxy's request/response path — raw provider traffic | the gateway asserts its authenticated caller's identity (how) |
Both implement the same normative
recipe: mint a step_id per model call,
evaluate the raw request before the model, evaluate the raw response before
the agent acts, release a bounded head on streams. A gateway is something you
operate — it is not an OGR-hosted service.
Status
There is no SDK — the API is the integration surface, and there is one recipe for every surface. Each integration below speaks the v1.0 wire:
| Surface | Plugin | Status |
|---|---|---|
| Higress (gateway, Go/WASM) | guide · integrations/gateway/higress | v1.0 reference gateway integration — installs from the Higress console as an OCI artifact |
DeepSeek Harness (dsh) | integrations/agent/dsh | v1.0 reference agent-direct integration — its src/wire.ts is the canonical "two hand-rolled POSTs" example |
| litellm | integrations/agent/litellm | v1.0 |
| Claude Code | guide | v1.0 — ⚠️ the guide below is out of date and is being rewritten |
| Codex · opencode · OpenClaw · Hermes · LangGraph | integrations/agent/ | v1.0 |
| OpenAI/Anthropic gateway example · mitmproxy | integrations/gateway/ | v1.0 |
Guides
⚠️ These three guides are out of date and are being rewritten — the plugins themselves speak the current wire, the prose below does not. Each carries its own note:
- Claude Code — a
PreToolUsehook denies risky tool calls (curl|bash, obfuscated exec, non-allowlisted egress, credential reads) before they run, even in bypass mode. - Hermes + srt (personal) — one laptop,
OS-level filesystem and network isolation from one
policy.json. - Hermes + OpenShell (team) — multi-tenant container isolation with a central OPA/Rego egress proxy.
No plugin for your stack? You don't need one — the quickstart is the whole integration, two POSTs per model call.