AgentGuard plugin · Free on one machine
Limit how many agents
Claude Code and Codex can start.
An interactive Claude Code session has no built-in token or dollar budget. AgentGuard adds a limit on how many agents Claude can start and on how many tokens a session can use, on from the first session. In an interactive Claude Code session, the 16th sub-agent Claude tries to start within 15 minutes of work waits for your yes in Claude Code's own prompt, which the agent cannot answer. Where no prompt can appear (print mode, bypass permissions, Codex), it is refused.
Install from the public repository
Choose Claude Code or Codex.
Codex and ChatGPT desktop (local tasks)
codex plugin marketplace add agentguard-run/agentguard-codex-plugincodex plugin add agentguard@agentguardIn the folder Codex installed the plugin into:
cd ~/.codex/plugins/cache/agentguard/agentguard/*/ && npm ci
Codex does not install the plugin's dependencies, so the third command runs npm ci in ~/.codex/plugins/cache/agentguard/agentguard/, then the version folder inside it (under $CODEX_HOME instead of ~/.codex if you set one). Use Node.js 22 on macOS or Linux. Windows is not verified. Start a new session, open /hooks, read the commands and trust them. For Codex 0.154, this marketplace installs a compatible copy of the plugin. AgentGuard runs on your computer in the Codex CLI and in local tasks in the ChatGPT desktop app. It does not run in Cloud Work, on the web or mobile, in Codex cloud or in the Codex IDE extension.
Claude Code
claude plugin marketplace add agentguard-run/agentguard-codex-pluginclaude plugin install agentguard@agentguard
That is the whole install: Claude Code installs the plugin's dependencies by itself. Accept Claude Code's usual install and folder trust prompts. Use its read-only /hooks menu to see the plugin's hooks. In either host, if AgentGuard says its dependencies are missing, run npm ci in the folder it names, then start a new session; see the installation details.
AgentGuard checks each tool call Claude or Codex makes on your computer against your rules: which tools it may use and at what level (read, write or payment), which tools it must never touch, and how much it may spend per project or per agent. Burn limits how many sub-agents Claude starts and how many tokens a session uses. The plugin keeps a signed record of every decision and what happened next on your computer, with fingerprints and sizes instead of your files' text.
Free on one machine, with every limit on. Solo covers up to three machines; Team puts one set of rules on every seat. See plans and pricing. To add a key, ask the agentguard-policy skill to activate license <KEY>.
A record you can inspect
One decision and what happened next.
Every decision and what happened next are signed rows on your computer: names, fingerprints and sizes, never what a tool read or wrote. A recent record made with the limits on, and its public key, are on the security page, and you can check any row at agentguard.run/verify.
What it covers and what it does not.
AgentGuard sees the tool calls Claude Code and Codex pass to their hooks, including MCP tools. In Claude Code, WebSearch and WebFetch are covered. In Codex and ChatGPT desktop local tasks, tools that run on OpenAI's side, such as WebSearch, are not. AgentGuard does not run in Cloud Work, web or mobile ChatGPT, Codex cloud or the Codex IDE extension. In Codex, typing more into a shell you already approved is not checked again, and some special tools can skip the check.
If AgentGuard hits an error or runs out of time, it lets the call through (fail-open) and warns you when it can. Hooks that are turned off or not trusted check nothing. AgentGuard adds a check on your computer; the service that holds your documents or payments still decides who can reach them.
Read the runtime and durability details · Enterprise installation guide · Public repository