Resources · Showcase

Integration showcase

Every integration below is a plugin in the API → SDK → Plugin stack: a hook for one surface that turns actions into GuardEvents and enforces Verdicts, with an SDK doing the wire work underneath. Same contract everywhere; pick the surfaces you have.

Built something OGR-conformant? Add it to this page.

Agent hooks

Intercept the agent's own tool and lifecycle hooks: every tool call becomes a GuardEvent before it runs.

Claude Code

marketplace plugin

A PreToolUse hook that judges each risky tool call and returns deny, ask, or allow before it runs. Hooks fire above the permission system, so a deny holds even in bypass mode — the one place the built-in classifier can't reach. Install with /plugin marketplace add openguardrails/openguardrails.

Codex

marketplace plugin

Two complementary hooks: a PermissionRequest hook that removes prompts for calls the runtime judges safe (auto mode), and a PreToolUse guardrail that blocks dangerous calls even under bypassPermissions. Requires Codex ≥ 0.122.

opencode

npm · openguardrails-instrumentation-opencode

A pure opencode plugin on the tool.execute.before hook — no core changes, no fork. Deterministic text/regex rules with no model required, or your own model as an LLM judge. Pulls in @openguardrails/core, the JS core runtime.

OpenClaw

npm · openguardrails-instrumentation-openclaw

Guards both before_tool_call and outbound message_sending, restrict-only by design. require_approval maps to OpenClaw's native /approve human gate: the plugin decides, the user approves, the host enforces.

Hermes

PyPI · openguardrails-instrumentation-hermes

One policy.json enforced across all three altitudes — tool calls, real exec, and the sandbox boundary (srt or OpenShell) — correlated by guard_id and provenance. Pulls in openguardrails, the Python core runtime.

LangGraph

PyPI · openguardrails-instrumentation-langgraph

For hand-rolled agents with no plugin marketplace: a drop-in ToolNode that judges every tool_call before it runs, using LangGraph's own interrupt() as the human-approval gate. A library you import, not a product you configure.

Gateway hooks

Intercept the LLM protocol itself: judge prompts, completions, and tool traffic on the wire, before the model or the caller sees them.

OpenAI / Anthropic proxy

PyPI · openguardrails (runnable example)

A runnable reference proxy that terminates the OpenAI and Anthropic wire protocols, normalizes each request and response into GuardEvents, and enforces one policy through the Python core. Shows gateway authors how to bind their own gateway to OGR; not a hosted service.

Higress

WASM plugin · oci://docker.io/openguardrails/higress

A Higress WASM plugin that speaks OGR directly to a runtime — POST /v1/evaluate on the request path, /v1/ingest for observations. Stateless by design; installs from the Higress console as an OCI artifact.

mitmproxy

Python addon · pip install from source

A mitmproxy addon that puts an OGR runtime on your agent's LLM traffic. Pure PEP: it carries no detection logic and holds no policy — every Verdict comes from the runtime you configure, the same policy your other observation points share.

Sandbox hooks

Enforce policy at the boundary that actually executes: process, filesystem, and network — regardless of what the agent claimed it would do.

Anthropic srt & NVIDIA OpenShell

planned standalone examples

Standalone examples for Anthropic's Sandbox Runtime (srt) and NVIDIA OpenShell are planned. Today, the Hermes integration demonstrates both backends end to end: the same declarative OGR policy compiles to srt (OS-level, no containers) or OpenShell (containers + egress proxy).

eBPF

Observe kernel-level activity and map it to the sandbox observation point — no separate wire contract.

eBPF sensor

build from source (CO-RE)

The native OGR reference at the kernel altitude: a small CO-RE program watches exec, file open, and network connect for one agent process tree; a userspace PEP maps each to a GuardEvent, asks the runtime for a Verdict, and enforces it. Below the harness, so shelling out or spawning a subprocess doesn't bypass it.