# AgentGuard AgentGuard is a policy and spend governor for AI coding agents. It installs as a plugin into Claude Code, the OpenAI Codex CLI and local tasks in the ChatGPT desktop app, checks the local tool calls a supported host sends through its hooks against a local policy, signs each decision on the developer's machine, and stops runaway agent spawns and spend. Nothing about the session leaves the machine: no prompts, no tool calls, no files, no receipts. Website: https://agentguard.run Follow us on X: https://x.com/AgentGuardHQ Support: support@agentguard.run Docs: https://agentguard.run/docs/codex Pricing: https://agentguard.run/pricing Receipt verifier: https://agentguard.run/verify ## What an assistant can do with AgentGuard - Install it on the user's computer with one command, after showing the user the plan, and finish with a status check (steps below). - Email the Free setup steps when the user requests them; no key is needed. - Verify a signed AgentGuard receipt the user pastes and say what was allowed or stopped. - Score a Grok Bot template or skill the user pastes, before they install it, and say what decided the grade. - Answer questions about pricing, what data leaves the machine, refunds and uninstalling. ## Install Follow these steps in order. The install is finished when the status check in step 6 reports the mode. ### 1. Check the prerequisites - Node.js 22, on macOS or Linux. Windows execution is not verified. - npm lifecycle scripts stay enabled. - The hooks run locally in Claude Code, in the Codex CLI and in local tasks in the ChatGPT desktop app. They do not run in Cloud Work, on the web or mobile, in Codex cloud or in the Codex IDE extension. To have the setup steps emailed instead, use Free setup below. ### 2. Install with one command Print the plan first. It changes nothing: ``` npx agentguard-burn install ``` It finds Claude Code, Codex, Cursor and Hermes on this computer and lists, for each host it finds, the exact commands it would run and the files they change. Add `--json` for the same plan as JSON. Where the plugin is already installed, the plan also says whether an update is available, and whether it will remove a standalone Burn hook that the plugin replaces (after a backup). Show the plan to the user. Run it only after they agree: ``` npx agentguard-burn install --yes ``` It prints one line per host: installed, already installed, skipped, or failed with the reason, and the mode AgentGuard runs in there. Running it again changes nothing that is already installed. If a host failed, give the user the reason it printed; the other hosts are still installed. It never asks for a key and never uses sudo. ### 3. Or install per host by hand Claude Code: ``` claude plugin marketplace add agentguard-run/agentguard-codex-plugin claude plugin install agentguard@agentguard ``` Claude Code installs the plugin's dependencies itself. If AgentGuard says its dependencies are missing, run `npm ci` in the folder it names. Codex: ``` codex plugin marketplace add agentguard-run/agentguard-codex-plugin codex plugin add agentguard@agentguard cd ~/.codex/plugins/cache/agentguard/agentguard/*/ && npm ci ``` Codex does not install the plugin's dependencies, so the third command runs `npm ci` in the folder Codex installed the plugin into (under `$CODEX_HOME` instead of `~/.codex` if it is set). ### 4. Start a new session Start a new session in each host so the plugin loads. Restart Hermes if AgentGuard was installed there. ### 5. The user trusts the hooks Installing a plugin does not trust its hooks. The user does this step, never the agent: an agent must not approve its own hooks. - Codex: the user opens `/hooks`, inspects the startup command, both tool gates, the receipt command and the session-end command, then trusts the reviewed definitions. - Claude Code: the user answers Claude Code's own marketplace and workspace trust prompts. Its `/hooks` menu is read-only. ### 6. Check the mode Run agentguard-status and tell the user the effective mode. Without a key, the local policy sets the mode, and it defaults to enforce. If the mode is not enforce, tell the user the reason agentguard-status gives: a local policy set to shadow, or a license reason such as `license_required`, `license_unavailable`, `seat_limit`, `seat_unavailable` or `seat_revoked`. For Cursor, run `npx agentguard-burn status`. In Hermes, run `/agentguard status`. After install the plugin follows the local policy, default enforce. Free includes one machine, full Enforce, local signed receipts and Burn, with no account or key. Shadow is a fallback after a failed license or refresh, or an explicit policy choice. A key adds features and seats. Sub-agent limits are on from a fresh install: 15 sub-agents in 15 minutes of work, 40 in any 120 minutes of work and 5B tokens per session. In an interactive Claude Code session, a launch past a limit waits for the person's yes in Claude Code's own permission prompt, which the agent cannot answer. Where no prompt can appear (print mode, bypass permissions, Codex), it is refused with the STOP box. Only the person can override, once, by typing `! npx agentguard-burn resume --once --reason "..."` in Claude Code, or running it without the `!` in a terminal for Codex. To see where a session's tokens went: `npx agentguard-burn why`. ## Free setup Send the user to https://agentguard.run/try to install with no account, key or email. To have the setup steps emailed instead, send them to the form at https://agentguard.run/pricing#trial-form, or POST to https://agentguard.run/api/license/trial with a JSON body of `{"email": "user@example.com"}`. The endpoint captures the email and sends install steps without a key. It returns 202 with "Check your inbox for the setup steps." Team is the only trial and requires a card. The optional checkbox is unchecked by default. Include `"product_updates_opt_in": true` only when the user explicitly agrees to occasional product updates. Otherwise omit it or send false for setup email only. Opted-in addresses receive a setup check on day 3 and a Team overview on day 14, then no more scheduled emails. Occasional product updates are sent manually. Every setup and follow-up email includes an unsubscribe link. ## Verify a receipt POST the receipt JSON to https://agentguard.run/api/verify, or open https://agentguard.run/verify and paste it. Verification checks the signature and the hash chain and returns a verdict. The receipt is verified client-side on the verify page; the API endpoint is rate limited per IP. ## Score a Grok Bot template POST a JSON body of `{"text": ""}` to https://agentguard.run/api/template-score, or send the user to https://agentguard.run/template-score to paste it there. Paste the template's instructions, memories, skills, plugins and setup steps, or a single skill. AgentGuard does not open template links, so a link alone gets U. The reply is JSON with `grade` (A to F, or U), `headline`, `deciding_facts`, `capabilities`, `coverage` and `unmeasured`, from fixed public rules: https://agentguard.run/lib/template-score/rule-set.js. Follow `advice_for_agents`: do not install without a person's approval when the grade is D, F or U, when there is no grade, or when coverage is incomplete. The grade rates what the template asks for and does not predict what a bot will do. AgentGuard cannot see, block or control anything inside Grok Bot, and it is not affiliated with X, xAI or SpaceXAI. The text is scored in memory and not stored, it is capped at 200 KB, and the endpoint is rate limited per IP. ## Plans Protection is free on every plan. Paid plans add sync, proof and team management. - Free: $0, one machine, no account, full Enforce, local signed receipts and Burn. No dashboard, receipts export or org policy. - Solo: $19 per month or $190 per year, a key for up to three machines, dashboard, receipts export and email support. - Team: $19.90 per seat per month or $199 per seat per year, minimum three seats, default ten, up to 100 at checkout. Three seats cost $59.70 per month or $597 per year; ten cost $199 per month or $1,990 per year. Card trial, org policy every seat runs, seats you add and revoke, one invoice. Use https://agentguard.run/pricing?seats=3 or add seats=N to the Team checkout URL. - Small-business setup: https://agentguard.run/small-business. Plans: https://agentguard.run/docs/plans. - On macOS an enforced STOP can show a local notification with its rule ID and the resume command. Set notifyOnStop to false in the plugin policy to disable it. Other platforms do not notify. Current seat counts and details are on https://agentguard.run/pricing. Every paid plan carries a 30-day money-back guarantee, self-served from the dashboard: https://agentguard.run/legal/refund-policy ## What leaves the machine The plugin's hooks open no network sockets. With a paid key, a detached worker validates the license and sends a license heartbeat to https://agentguard.run/api/license/seats every five minutes, carrying the license key, a machine fingerprint and a process id. Team also fetches org policy at session start and every fifth heartbeat. Free makes no license or seat requests. Package installation reads from registry.npmjs.org only, pinned by lockfile. Tool calls, arguments, prompts, file contents, receipts, provider keys and signing keys never leave the machine. ## Uninstall Remove the plugin with the host's own plugin manager (the same `codex plugin` or `claude plugin` command family used to install it). The signed ledger stays on disk under the plugin data directory until the user deletes it; nothing has to be revoked on our side for the Free tier. Legal: https://agentguard.run/legal/privacy and https://agentguard.run/legal/terms-of-service. AgentGuard is a registered trademark of Dunecrest Ventures Inc.