A setup guide for AgentGuards, a self-hosted service that checks or restricts agent actions. It configures the service address, access key, and optional certificate settings.

Use it to configure and verify AgentGuards against a private appliance, including its URL, API key, trusted certificate, and temporary certificate-check bypass.

It prevents the coding agent from connecting to the wrong service and helps diagnose connection failures caused by missing credentials or certificates.

setup — Skill for Claude Code by alelaguard/agentguards-plugins

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add alelaguard/agentguards-plugins --skill setup

Clone the repo

git clone --depth 1 https://github.com/alelaguard/agentguards-plugins

Made for: Claude Code.

Or install agentguards, the plugin that ships this one along with the rest of its 3 skills, 3 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/alelaguard/agentguards-plugins/setup/github.svg)](https://agentmods.dev/skills/alelaguard/agentguards-plugins/setup)

Your own site

<a href="https://agentmods.dev/skills/alelaguard/agentguards-plugins/setup"><img src="https://agentmods.dev/badge/skills/alelaguard/agentguards-plugins/setup/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/alelaguard/agentguards-plugins/setup"><img src="https://agentmods.dev/badge/skills/alelaguard/agentguards-plugins/setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 47 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,395 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00047	$0.02395
Opus 5.5	$0.00019	$0.00958
Sonnet 5.5	$0.00009	$0.00479
Haiku 4.5	$0.00005	$0.00239

Measured yesterday against content hash 1018a818cffa, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

setup scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Subtle steeringmediumPrompt injection

Instructions that bias recommendations or shape behaviour without the user noticing.

- **Never tell them to edit a shell profile** (`~/.bashrc`, `~/.zshrc`, a

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

1-5.** Writing `~/.claude/settings.json` there is pointless: the sandbox is

claude-directory/skills/setup/SKILL.md · 207 lines

How it starts

The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AgentGuards setup

Set up AgentGuards for the user. The plugin already bundles the enforcing hooks — the only thing missing is their API key.

Never do these

They are all wrong, and every one of them has been given to a real user:

Never print an export or setx or [Environment]::SetEnvironmentVariable command for them to run. You have file tools. Use them.
Never tell them to edit a shell profile (~/.bashrc, ~/.zshrc, a PowerShell profile). The Claude Desktop app never reads a shell profile, so this does nothing for desktop users and wastes their time.
Never mention a "Configure" screen. There isn't one. The desktop app has no settings screen for this key.
Never end your turn by asking whether they'd like you to set it up. Setting it up is what this skill is for. Ask only for the key itself.

If you catch yourself writing any of the above, stop and write the file instead.

Steps

Check which surface you are on, before anything else. Run this yourself — it is a check you perform, not a command to hand the user:
```
[ "$CLAUDE_CODE_REMOTE" = "true" ] && echo cloud || echo local
```
If it prints cloud you are in a Claude Code cloud session (Cowork, on claude.ai/code). Stop and follow "Cloud sessions" below instead of steps 1-5. Writing ~/.claude/settings.json there is pointless: the sandbox is an ephemeral container with its own /root home, thrown away when the session ends, and its user-scope settings are never read anyway.

Use CLAUDE_CODE_REMOTE and nothing else. In particular do not test CLAUDE_CODE_BRIDGE_SESSION_ID — that is Remote Control, a local session exposed to the web, and it is set in ordinary local terminal sessions. Using it here would send Remote Control users down the cloud path and refuse to write the file that would have worked for them.
Find the current key. Check the AGENTGUARDS_API_KEY environment variable and the env block of the settings file for this OS:
- Windows: %USERPROFILE%\.claude\settings.json
- macOS/Linux: ~/.claude/settings.json

Read the full file on GitHub · 207 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday Changed · +162 lines · -5 tokens per session scan A → C 1018a818cffa
1mo ago First seen · 45 lines · 52 tokens per session scan A e1cd38de1b36

Subscribe to this mod's changes

setup is a skill published in the GitHub repository alelaguard/agentguards-plugins (4 stars, last pushed yesterday), licensed MIT. It adds 47 tokens to every session and 2,395 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 2 findings (subtle steering, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Guardrails Security ai-security claude-code-plugin codex llm-security

clawmoat

Real-time AI agent security scanner. Detects prompt injection, jailbreak attempts, credential/secret leaks, PII exposure, and dangerous tool calls. Activate when: (1) scanning inbound messages or tool outputs for prompt injection, (2) checking outbound content for credential leaks or PII, (3) auditing agent session…

darfaz/clawmoat · 107 tokens

integrate-arcjet-guard-genkit

Integrate Arcjet security into a Genkit JS agent using @arcjet/guard — wrap ai.defineTool, put guardMiddleware on generate({ use }) for unwrapped / MCP / filesystem tools, and read a caller-owned id from generate({ context }). Use when asked to add Arcjet to genkit, rate limit its tools, screen inbound messages, or…

arcjet/arcjet-js · 89 tokens

integrate-arcjet-guard-langchain

Integrate Arcjet security into a LangChain JS createAgent using @arcjet/guard — wrap tool() / StructuredTool, put guardMiddleware on createAgent({ middleware }) for MCP / unwrapped tools, and read configurable.threadid for correlation. Use when asked to add Arcjet to langchain createAgent, rate limit its tools, screen…

arcjet/arcjet-js · 101 tokens

integrate-arcjet-guard-langgraph

Integrate Arcjet security into a LangGraph Graph API agent using @arcjet/guard — wrap tool() / StructuredTool, wrap ToolNode for unwrapped MCP tools, and read threadid for correlation. Use when asked to add Arcjet to a LangGraph StateGraph / ToolNode agent, rate limit its tools, screen inbound messages, or block…

arcjet/arcjet-js · 87 tokens

integrate-arcjet-guard-mastra

Integrate Arcjet security into a Mastra agent using @arcjet/guard — wrap createTool execute, screen input/output with a Processor tripwire, and gate unwrapped MCP/workspace tools with hooks. Use when asked to add Arcjet to a Mastra agent, rate limit its tools, screen inbound messages, or block prompt injection / PII.

arcjet/arcjet-js · 82 tokens

integrate-arcjet-guard-google-adk

Integrate Arcjet security into a Google ADK JS app using @arcjet/guard — put guardPlugin first on Runner({ plugins }) so beforeToolCallback gates tools, and read a caller-owned id from helper options or context. Use when asked to add Arcjet to Google ADK, @google/adk, rate limit its tools, screen inbound messages, or…

arcjet/arcjet-js · 111 tokens

setup