@agentguardsco/opencode-plugin

Stop prompt injection, secret leaks and destructive commands before your coding agent acts on them. Works with Claude Code, OpenAI Codex, Gemini CLI, GitHub Copilot CLI and OpenCode.

Your agent reads web pages, PDFs, images and tool output you never see. Any of them can carry instructions written for the agent, not for you. AgentGuards hooks into the agent itself and checks every prompt, shell command and piece of fetched content before the agent acts on it.

What gets blocked

A real, unedited run: Claude Code with the AgentGuards plugin is asked to apply the "performance tips" from a blog post (a test page served locally) that carries instructions aimed at the agent. AgentGuards blocks the page content, and Claude leaves src/app.py untouched.

* Claude Code and Codex. Everything else in the table: all five agents.

Every block tells the agent — and you — what was stopped and why. Blocks are fail-closed by default; set AGENTGUARDS_FAIL_OPEN=true if you prefer availability over enforcement.

Install — one line per agent

Claude Code and Codex: the installer signs you in through your browser, adds the plugin to whichever of the two you have, and saves your key. Nothing to copy or paste.

Installed agentguards from Claude's plugin directory? You're already set. Don't also run the installer or add agentguards-claude: every hook would run twice.

Copilot CLI, OpenCode and Gemini CLI also need a key. Create a free account, copy a key from the dashboard, and add it to your shell profile:

export AGENTGUARDS_API_KEY=ag_your_token_here

New accounts start with 1,000 free requests.

/plugin marketplace add alelaguard/agentguards-plugins
/plugin install agentguards-claude@agentguards

codex plugin marketplace add alelaguard/agentguards-plugins
codex plugin add agentguards-codex@agentguards-codex

Full configuration per agent: Claude Code · Codex · Gemini CLI · Copilot CLI · OpenCode

How it works

 your prompt / shell command / fetched page, PDF or image
                         │
        agent hook (this repo, source-available)
                         │
                AgentGuards API  ──►  allow · ask · block
                         │
     the agent only sees what was allowed

The plugins in this repo are thin hooks: they hand each prompt, command and piece of fetched content to the AgentGuards API, then enforce the answer inside the agent. Detection — injection and jailbreak classifiers, secret and PII scanning, command policy — runs server-side, so it improves without you reinstalling anything. How the hooks work · Images and PDFs · OWASP Agentic mapping · Privacy

Plugins

Versions are the current release in this repo; our release checks fail if they drift from the plugin manifests. To see what you have installed, use your agent's own listing (/plugin in Claude Code).

Self-hosted (AWS Marketplace appliance)

Running the AgentGuards appliance in your own AWS account? Use these instead — hooks only, no bundled MCP server, and no default URL, so they can never talk to the hosted service by accident.

About this repository

This repository holds the released plugins and is what every install method reads from. It is published from our private development repository on each release, so it doesn't carry our tests or development history. Issues and security reports are welcome (SECURITY.md); we can't accept pull requests here.

License

The hosted plugins (claude/, claude-directory/, codex/, gemini/, copilot/, opencode/) are source-available under the Functional Source License 1.1, MIT Future License: free to read, use and modify for anything except a competing product, and each version becomes MIT two years after release. The self-hosted plugins and everything else here are MIT. Earlier releases stay MIT. See LICENSING.md for the details and TRADEMARKS.md for the name and logo.