Resources · Showcase
Integration showcase
Every integration below is a plugin: a hook for one surface that forwards raw provider bodies as GuardEvents and enforces Verdicts, speaking the Runtime API directly — there is no SDK layer. Same contract everywhere; pick the surfaces you have. Higress and dsh are the v1.0 references; every integration listed speaks the same wire (see plugin status).
Built something OGR-conformant? Add it to this page.
Agent hooks
Intercept the agent's own tool and lifecycle hooks: every tool call becomes a GuardEvent before it runs.
Claude Code
marketplace plugin
A PreToolUse hook that judges each risky tool call and returns deny, ask, or allow before it runs. Hooks fire above the permission system, so a deny holds even in bypass mode — the one place the built-in classifier can't reach. Install with /plugin marketplace add openguardrails/openguardrails.
Codex
marketplace plugin
Two complementary hooks: a PermissionRequest hook that removes prompts for calls the runtime judges safe (auto mode), and a PreToolUse guardrail that blocks dangerous calls even under bypassPermissions. Requires Codex ≥ 0.122.
opencode
npm · openguardrails-instrumentation-opencode
A pure opencode plugin on the tool.execute.before hook — no core changes, no fork. Deterministic text/regex rules with no model required, or your own model as an LLM judge. Pulls in @openguardrails/core, the JS core runtime.
OpenClaw
npm · openguardrails-instrumentation-openclaw
Guards both before_tool_call and outbound message_sending, restrict-only by design. A block maps to OpenClaw's native /approve human gate: the plugin decides, the user approves, the host enforces.
Hermes
PyPI · openguardrails-instrumentation-hermes
One policy.json enforced from tool calls down to the sandbox boundary (srt or OpenShell), rewritten against the one-endpoint recipe.
LangGraph
PyPI · openguardrails-instrumentation-langgraph
For hand-rolled agents with no plugin marketplace: a drop-in ToolNode that judges every tool_call before it runs, using LangGraph's own interrupt() as the human-approval gate. A library you import, not a product you configure.
Gateway hooks
Intercept the LLM protocol itself: judge prompts, completions, and tool traffic on the wire, before the model or the caller sees them.
OpenAI / Anthropic proxy
PyPI · openguardrails (runnable example)
A runnable reference proxy that terminates the OpenAI and Anthropic wire protocols, normalizes each request and response into GuardEvents, and enforces one policy through the Python core. Shows gateway authors how to bind their own gateway to OGR; not a hosted service.
Higress
WASM plugin · oci://docker.io/openguardrails/higress
The v1.0 reference gateway integration: a Higress WASM plugin that mints a step_id per model call and evaluates the raw request and response bodies — two POSTs, tail-hold on streams. Stateless by design; installs from the Higress console as an OCI artifact.
mitmproxy
Python addon · pip install from source
A mitmproxy addon that puts an OGR runtime on your agent's LLM traffic. Pure PEP: it carries no detection logic and holds no policy — every Verdict comes from the runtime you configure, the same policy your other observation points share.
Sandbox hooks
Enforce policy at the boundary that actually executes: process, filesystem, and network — regardless of what the agent claimed it would do.
Anthropic srt & NVIDIA OpenShell
planned standalone examples
Standalone examples for Anthropic's Sandbox Runtime (srt) and NVIDIA OpenShell are planned. Today, the Hermes integration demonstrates both backends end to end: the same declarative OGR policy compiles to srt (OS-level, no containers) or OpenShell (containers + egress proxy).
eBPF
Observe kernel-level activity beneath the agent. The execution plane left the protocol in v0.7; this sensor predates that and awaits a future major version.
eBPF sensor
build from source (CO-RE)
A small CO-RE program that watches exec, file open, and network connect for one agent process tree, with a userspace PEP asking the runtime for a Verdict. Built for the pre-v0.7 execution plane; kept as a reference while that plane is out of scope.