Resources · Showcase
Integration showcase
Every integration below is a plugin in the API → SDK → Plugin stack: a hook for one surface that turns actions into GuardEvents and enforces Verdicts, with an SDK doing the wire work underneath. Same contract everywhere; pick the surfaces you have.
Built something OGR-conformant? Add it to this page.
Agent hooks
Intercept the agent's own tool and lifecycle hooks: every tool call becomes a GuardEvent before it runs.
Claude Code
marketplace plugin
A PreToolUse hook that judges each risky tool call and returns deny, ask, or allow before it runs. Hooks fire above the permission system, so a deny holds even in bypass mode — the one place the built-in classifier can't reach. Install with /plugin marketplace add openguardrails/openguardrails.
Codex
marketplace plugin
Two complementary hooks: a PermissionRequest hook that removes prompts for calls the runtime judges safe (auto mode), and a PreToolUse guardrail that blocks dangerous calls even under bypassPermissions. Requires Codex ≥ 0.122.
opencode
npm · openguardrails-instrumentation-opencode
A pure opencode plugin on the tool.execute.before hook — no core changes, no fork. Deterministic text/regex rules with no model required, or your own model as an LLM judge. Pulls in @openguardrails/core, the JS core runtime.
OpenClaw
npm · openguardrails-instrumentation-openclaw
Guards both before_tool_call and outbound message_sending, restrict-only by design. require_approval maps to OpenClaw's native /approve human gate: the plugin decides, the user approves, the host enforces.
Hermes
PyPI · openguardrails-instrumentation-hermes
One policy.json enforced across all three altitudes — tool calls, real exec, and the sandbox boundary (srt or OpenShell) — correlated by guard_id and provenance. Pulls in openguardrails, the Python core runtime.
LangGraph
PyPI · openguardrails-instrumentation-langgraph
For hand-rolled agents with no plugin marketplace: a drop-in ToolNode that judges every tool_call before it runs, using LangGraph's own interrupt() as the human-approval gate. A library you import, not a product you configure.
Gateway hooks
Intercept the LLM protocol itself: judge prompts, completions, and tool traffic on the wire, before the model or the caller sees them.
OpenAI / Anthropic proxy
PyPI · openguardrails (runnable example)
A runnable reference proxy that terminates the OpenAI and Anthropic wire protocols, normalizes each request and response into GuardEvents, and enforces one policy through the Python core. Shows gateway authors how to bind their own gateway to OGR; not a hosted service.
Higress
WASM plugin · oci://docker.io/openguardrails/higress
A Higress WASM plugin that speaks OGR directly to a runtime — POST /v1/evaluate on the request path, /v1/ingest for observations. Stateless by design; installs from the Higress console as an OCI artifact.
mitmproxy
Python addon · pip install from source
A mitmproxy addon that puts an OGR runtime on your agent's LLM traffic. Pure PEP: it carries no detection logic and holds no policy — every Verdict comes from the runtime you configure, the same policy your other observation points share.
Sandbox hooks
Enforce policy at the boundary that actually executes: process, filesystem, and network — regardless of what the agent claimed it would do.
Anthropic srt & NVIDIA OpenShell
planned standalone examples
Standalone examples for Anthropic's Sandbox Runtime (srt) and NVIDIA OpenShell are planned. Today, the Hermes integration demonstrates both backends end to end: the same declarative OGR policy compiles to srt (OS-level, no containers) or OpenShell (containers + egress proxy).
eBPF
Observe kernel-level activity and map it to the sandbox observation point — no separate wire contract.
eBPF sensor
build from source (CO-RE)
The native OGR reference at the kernel altitude: a small CO-RE program watches exec, file open, and network connect for one agent process tree; a userspace PEP maps each to a GuardEvent, asks the runtime for a Verdict, and enforces it. Below the harness, so shelling out or spawning a subprocess doesn't bypass it.