Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
APort Agent Guardrail intercepts every tool call an AI agent makes and checks it against a policy before the tool runs. The policy engine is deterministic and fail-closed — if the guardrail errors or denies a call, the tool is blocked. Install once; the OpenClaw plugin enforces policy automatically after that.
The guardrail runs in before_tool_call, so the agent cannot skip or work around it, unlike post-hoc logging or advisory-only checks.
When to use it
- Blocking unauthorized shell commands before an agent executes them
- Preventing message sends to unapproved recipients
- Auditing MCP tool calls across automated workflows
- Requiring policy approval before PR creation or merge
- Stopping accidental data exports in production environments
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: An AI agent attempts to send a WhatsApp message to an external number
- 1Agent prepares to call the messaging tool with target number and message content
- 2APort OpenClaw plugin intercepts the call in before_tool_call
- 3Guardrail script checks tool name 'messaging.message.send' and context JSON against the local or hosted passport policy
- 4Policy engine returns ALLOW (exit 0) or DENY (exit 1)
- 5If denied, the tool is blocked and the reason is written to decision.json
Tool either runs on ALLOW or is blocked, with the denial reason logged to decision.json
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.