Most of what an agent does is safe, and a rule can tell. OpenGuardrails decides those actions on your machine, with no network and no model. It sends only the ones a rule cannot decide to a model built to judge agent actions, so you stop being asked, and it tells you when something is wrong.

tool call -> local rules --- allow ------------------------------> runs
                         |-- deny ---------------------------------> refused
                         -- cannot tell -> OpenGuardrails model
                                             |-- allow ------------> runs
                                             |-- unsafe -----------> refused, the agent is told why
                                             -- your decision ----> the agent asks you

Unsafe and "your decision" are different things. A key on its way to an unknown host is a security problem, and it is refused. Nobody is asked to rule on it. Buying this lipstick is safe, and it is still your call.

• Your keys stay home. Secrets become placeholders before a request leaves your machine, side

• Local rules. A strict shell parser, a read-only allowlist, workspace boundaries and a small

• A refusal does not end the task. The agent is told what was refused and what it may do

• Sandbox and firewall. openguardrails run starts an agent where it cannot read your

• You can see everything. openguardrails decisions lists every decision, and

Status

Early, and honest about it. Tested end to end against the real harnesses through the local gateway, with no plugin, using the scripted models in cli/experiments:

| Agent | Rules and model enforced | Agent told why | Secrets kept from the model provider | Tool gets the real value | |---|---|---|---|---| | Hermes 0.20 | yes | yes | yes | yes | | OpenClaw 2026.6 | yes | yes | yes | yes | | DeepSeek Harness 0.2 | yes | yes | yes | yes |

Not available yet:

• The model API is not public yet. It has been tested with the real model through all three agents, but

• The package is not on npm yet. Install from a checkout, below.
• Asking you on your phone. Until then, a decision that is yours comes back to you through the agent.

Try it

Needs Node 22.12 or newer.

git clone https://github.com/openguardrails/openguardrails
cd openguardrails/cli && npm install && npm run build && npm link

Tell it about your model API in ~/.openguardrails/config.json, mode 0600:

{
  "gateway": {
    "upstreams": { "main": { "baseURL": "https://openrouter.ai/api/v1", "model": "qwen/qwen3.8-27b", "apiKeyEnv": "OPENROUTER_API_KEY" } },
    "routes": { "auto": ["main"] }
  }
}

openguardrails serve   # port 4180; set gateway.port in the config to change it

Then point your agent at http://127.0.0.1:4180/v1, with model auto and any string as its API key. That is the whole integration, and it works the same for every agent.

openguardrails connect turns on the model once it is public, and shows where to raise your quota. openguardrails decisions shows what happened. For an enterprise deployment, plugins and the gateway connect to OpenGuardrails AIRS instead, with no other change.

What is in this repository

| Path | What it is | |---|---| | cli/ | The openguardrails command: rules, local service, sandbox, firewall, gateway | | integrations/ | Plugins for agents and gateways | | benchmarks/ | The public evaluation. We enter too, and publish the results either way | | specification/ | The OGR wire protocol that the plugins speak |

For companies

OpenGuardrails AIRS is the enterprise product: organization-wide policy, audit, SSO, analytics and private deployment. It uses the same plugins and the same models. See openguardrails.com.

License

Apache-2.0.