meshguard-openclaw

Ecosystem expansion: this extension remains a first-class MeshGuard path for OpenClaw agents. AGT support, guardian sidecar, and egress enforcement add additional paths for mixed fleets; they complement this extension and the rest of the MeshGuard ecosystem.

Official MeshGuard extension for OpenClaw — AI agent governance, policy enforcement, and audit logging.

Overview

MeshGuard provides enterprise-grade governance for AI agents:

• Policy Enforcement: Define what actions your agents can and cannot perform
• Audit Logging: Complete trail of all agent actions for compliance
• Trust Tiers: Role-based access control for multi-agent systems
• Alerting: Real-time notifications for policy violations

This extension integrates MeshGuard with OpenClaw agents, enabling governance without code changes.

Installation

# npm
npm install meshguard-openclaw

# pnpm
pnpm add meshguard-openclaw

# Or via OpenClaw CLI
openclaw plugins install meshguard-openclaw

Quick Start

1. Get MeshGuard Credentials

Sign up at meshguard.app and create an agent to get:

• API Key (msk_xxx)
• Agent ID (agent_xxx)

2. Configure OpenClaw

Add to your openclaw.json:

{
  "plugins": ["meshguard-openclaw"],
  "meshguard": {
    "apiKey": "${MESHGUARD_API_KEY}",
    "agentId": "agent_xxx",
    "mode": "enforce"
  }
}

Or use environment variables:

export MESHGUARD_API_KEY=msk_xxx
export MESHGUARD_AGENT_ID=agent_xxx

3. Define Policies

Create policies in the MeshGuard dashboard or via API:

name: my-agent-policy
version: "1.0"
appliesTo:
  agentIds:
    - agent_xxx
rules:
  - effect: allow
    actions:
      - "tool:read"
      - "tool:web_search"
    description: Allow read operations
    
  - effect: deny
    actions:
      - "tool:exec"
    conditions:
      command_pattern: "rm -rf /*"
    description: Block destructive commands
    alert: critical

4. Run Your Agent

That's it! MeshGuard will now:

• Evaluate policies before each tool call
• Block actions that violate policies (in enforce mode)
• Log all actions to the audit trail

Configuration Options

Option	Type	Default	Description
enabled	boolean	true	Enable/disable governance
apiKey	string	required	MeshGuard API key
agentId	string	required	MeshGuard agent ID
gatewayUrl	string	https://dashboard.meshguard.app	MeshGuard gateway URL
mode	string	"enforce"	enforce, audit, or bypass
auditLevel	string	"standard"	minimal, standard, or verbose
cacheTimeoutMs	number	60000	Policy cache duration (ms)
failOpen	boolean	false	Allow actions if MeshGuard is unreachable

Modes

• enforce: Block policy violations, log all actions
• audit: Log all actions, but don't block violations (shadow mode)
• bypass: Disable governance entirely

How It Works

┌─────────────────────────────────────────────────────────────┐
│                      OpenClaw Agent                          │
│  ┌─────────────────────────────────────────────────────────┐│
│  │                    Tool Invocation                       ││
│  └────────────────────────┬────────────────────────────────┘│
│                           ▼                                  │
│  ┌─────────────────────────────────────────────────────────┐│
│  │              before_tool_call hook                       ││
│  │         ┌─────────────────────────────┐                 ││
│  │         │   MeshGuard Extension       │                 ││
│  │         │   - Evaluate policy         │                 ││
│  │         │   - Check cache             │                 ││
│  │         │   - Block if denied         │                 ││
│  │         └─────────────────────────────┘                 ││
│  └────────────────────────┬────────────────────────────────┘│
│                           ▼                                  │
│  ┌─────────────────────────────────────────────────────────┐│
│  │               Tool Execution (if allowed)               ││
│  └────────────────────────┬────────────────────────────────┘│
│                           ▼                                  │
│  ┌─────────────────────────────────────────────────────────┐│
│  │               after_tool_call hook                       ││
│  │         ┌─────────────────────────────┐                 ││
│  │         │   MeshGuard Extension       │                 ││
│  │         │   - Log to audit trail      │                 ││
│  │         │   - Record duration         │                 ││
│  │         │   - Capture result/error    │                 ││
│  │         └─────────────────────────────┘                 ││
│  └─────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                    MeshGuard Cloud                           │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │
│  │   Policy    │  │   Audit     │  │  Dashboard  │         │
│  │   Engine    │  │   Store     │  │     UI      │         │
│  └─────────────┘  └─────────────┘  └─────────────┘         │
└─────────────────────────────────────────────────────────────┘

Security Considerations

• Sensitive data redaction: Passwords, tokens, and API keys are automatically redacted from audit logs
• Local caching: Policies are cached locally to minimize latency and network dependency
• Fail-safe defaults: By default, actions are blocked if MeshGuard is unreachable (failOpen: false)

Documentation

• MeshGuard Docs
• OpenClaw Integration Guide
• Policy Reference
• API Reference

Support

• Issues: GitHub Issues
• Email: support@meshguard.app
• Discord: MeshGuard Community

License

MIT © MeshGuard