agentmods.dev

claw-shield AGENTS.md

A project instruction file for Claw Shield, a system that governs how AI agents send requests and use tools. It describes privacy routing, activity tracking, automated checks by another model, and the dashboard components.

In plain words
What is it for?
For working on the TypeScript client, Cloudflare relay, privacy-protected model requests, agent activity records, risk checks, and dashboard views.
Why use it?
It gives agents a map of the system so changes can respect the separation between the client plugin, relay service, and dashboard.

Instructions file for CodexOpenCode

24 5mo ago C scan 2,046 tokens original MIT
View the source file xinxin7/claw-shield
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/xinxin7/claw-shield/agents-md
Clone the repo
git clone --depth 1 https://github.com/xinxin7/claw-shield

Made for: Codex, OpenCode.

Per session 2,046 This file is loaded in full into every session.
When invoked 2,046 The same file — it is already loaded in full.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02046 $0.02046
Opus 5 $0.01023 $0.01023
Sonnet 5 $0.00409 $0.00409
Haiku 4.5 $0.00205 $0.00205

Measured 2d ago against content hash f1a6e52c1ed0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

claw-shield AGENTS.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

- Test Judge: ask the agent to perform a sensitive operation (e.g., `rm -rf`, `DROP TABLE`). The dashboard should show a Judge verdict card (green = ALLOW, red = DENY) alongside the tool call

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Client status: `curl http://127.0.0.1:18789/api/plugins/claw-shield/status`
AGENTS.md · 131 lines

How it starts

The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md — For AI Agents Working on This Codebase

This file is written for you, the AI agent. It describes the Claw Shield project structure, conventions, and how to make effective changes.

What Is Claw Shield

Claw Shield is an AI agent governance infrastructure. It sits between agents and model providers, providing:

  1. Privacy routing via OHTTP (Oblivious HTTP) relay-gateway architecture
  2. Real-time telemetry — captures chain-of-thought reasoning, tool call decisions, and execution results
  3. Model-as-a-Judge — automated audit of high-risk tool calls via a second model, with allow/deny verdicts
  4. A hosted dashboard for visualizing agent behavior as a reasoning-to-action waterfall, including Judge audit results

Architecture (Three Components)

client/ — OpenClaw Plugin (TypeScript)

  • Entry point: client/index.ts → registers ClawShieldPlugin
  • Core logic: client/src/ohttp-shield.plugin.ts
  • Intercepts outbound model requests, wraps in OHTTP, injects x-claw-shield-project-id and x-claw-shield-session-id headers
  • Session ID rotates on new user prompts; persists across tool-result continuations within one agent turn
  • Project ID is auto-generated UUID, persisted at ~/.openclaw/plugins/claw-shield/.project-id
  • Dependencies: bhttp-js, ohttp-js

relay/ — Cloudflare Worker (JavaScript)

  • Simple pass-through relay (relay/index.js)
  • Sees the client's IP but never decrypts the OHTTP payload
  • Deployed via wrangler deploy from relay/

gateway/ — Cloudflare Worker (Rust/WASM)

  • Entry: gateway/src/lib.rs — OHTTP decryption, request routing, Judge integration, telemetry orchestration
  • Telemetry: gateway/src/telemetry.rs — SSE parsing for OpenAI/Anthropic/Gemini, CoT extraction, tool call logging, sensitivity detection, D1 storage
  • Judge: gateway/src/judge.rs — Model-as-a-Judge logic: should_invoke_judge(), invoke_judge(), build_intervention_response(), provider-specific API calls
  • Skills: gateway/src/skills/judge_audit.md — the Judge's system prompt (evaluation criteria), loaded via include_str!("skills/judge_audit.md")
  • Dashboard: gateway/src/dashboard.html — single-page app embedded via include_str!(), served at /dashboard
  • D1 database TELEMETRY_DB stores trace records in a traces table indexed by (project_id, timestamp_ms), with judge_verdict (JSON) and judge_action (TEXT) columns for Judge audit results
  • Migrations live in gateway/migrations/ — apply with npx wrangler d1 migrations apply claw-shield-telemetry --remote
  • KV namespace WAITLIST is used only for the waitlist feature (low-volume, read-heavy)
  • API endpoints: GET /api/traces?project=X, GET /api/summary?project=X (summary includes judge_triggered, judge_allowed, judge_denied)
  • Built with worker-build --release, deployed via wrangler deploy from gateway/

Read the full file on GitHub · 131 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 131 lines · 2,046 tokens per session scan C f1a6e52c1ed0

Subscribe to this mod's changes

claw-shield AGENTS.md is an instructions file published in the GitHub repository xinxin7/claw-shield (24 stars, last pushed 5mo ago), licensed MIT. It adds 2,046 tokens to every session, about $0.0102 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Building agentsSecurityai-agentai-agentschain-of-thoughtgovernancemonitoringohttp
Related

Other instructions, from other repositories

agent-governance-toolkit copilot-instructions.md

Copilot instructions for microsoft/agent-governance-toolkit, covering copilot instructions for agent-governance-toolkit, architecture, build, test, and lint, python and install (editable, all extras).

microsoft/agent-governance-toolkit · 5,833 tokens

clawmetry AGENTS.md

Instructions for vivekchand/clawmetry, covering agents.md — for ai coding agents, quick context, where new code goes (open-core split), the rules that bite and common tasks.

vivekchand/clawmetry · 1,608 tokens

clawmetry CLAUDE.md

Instructions for vivekchand/clawmetry, covering claude.md — clawmetry, what is this?, architecture, key files and core.

vivekchand/clawmetry · 5,494 tokens

dynatrace-mcp copilot-instructions.md

Instructions for dynatrace-oss/dynatrace-mcp, covering dynatrace mcp server, guidelines, repo structure, coding guidelines and dependencies.

dynatrace-oss/dynatrace-mcp · 831 tokens

dynatrace-mcp typescript.instructions.md

Instructions for dynatrace-oss/dynatrace-mcp, covering mcp server – typescript agent instructions, reference documentation, project-specific patterns, console.error for logging and implementing mcp tools.

dynatrace-oss/dynatrace-mcp · 797 tokens

vnx-orchestration CLAUDE.md

Instructions for Vinix24/vnx-orchestration, covering vnx governance, mandatory report contract, dispatch lanes, path resolution and event streams.

Vinix24/vnx-orchestration · 2,220 tokens