Plugins
A plugin is a hook that speaks the API directly: it binds one surface's native interception points to the OGR contract — forwarding raw provider bodies as GuardEvents, enforcing Verdicts — with the same two POSTs per model call your own agent would make (there is no SDK layer). Install one and a real agent is guarded without writing code.
Two integration points
| Category | Binds | Who fills the four-tuple |
|---|---|---|
| Agent-direct hooks | a harness's model-call lifecycle — the loop's own seams | the agent asserts its own identity |
| Gateway hooks | an LLM proxy's request/response path — raw provider traffic | the gateway asserts its authenticated caller's identity (how) |
Both implement the same normative
recipe: mint a step_id per model call,
evaluate the raw request before the model, evaluate the raw response before
the agent acts, hold the tail on streams. A gateway is something you
operate — it is not an OGR-hosted service.
Status
The v0.6 SDK packages were retired in v0.7 — the API is the integration surface. v0.8 merged the two integration recipes into one, and every integration below speaks it (v1.0 releases the same wire unchanged):
| Surface | Plugin | Status |
|---|---|---|
| Higress (gateway, Go/WASM) | guide · integrations/gateway/higress | v1.0 reference gateway integration — installs from the Higress console as an OCI artifact |
DeepSeek Harness (dsh) | integrations/agent/dsh | v1.0 reference agent-direct integration — its src/wire.ts is the canonical "two hand-rolled POSTs" example |
| litellm | integrations/agent/litellm | v1.0 |
| Claude Code | guide | v1.0 (the guide below still describes the v0.6-era plugin) |
| Codex · opencode · OpenClaw · Hermes · LangGraph | integrations/agent/ | v1.0 |
| OpenAI/Anthropic gateway example · mitmproxy | integrations/gateway/ | v1.0 |
Guides
These guides predate v0.8 and describe the v0.6-era plugins; each carries a status note:
- Claude Code — a
PreToolUsehook denies risky tool calls (curl|bash, obfuscated exec, non-allowlisted egress, credential reads) before they run, even in bypass mode. - Hermes + srt (personal) — one laptop,
OS-level filesystem and network isolation from one
policy.json. - Hermes + OpenShell (team) — multi-tenant container isolation with a central OPA/Rego egress proxy.
No plugin for your stack? You don't need one — the quickstart is the whole integration, two POSTs per model call.