Connectors
Thirteen active connectors share one adapter interface while exposing connector-specific proxy, hook, policy, telemetry, and approval capabilities.
Connectors are the adapter layer between agent frameworks and DefenseClaw. They share one Go interface, but each connector advertises only the capabilities its agent actually exposes. Proxy routing, lifecycle hooks, custom policy callbacks, component discovery, CodeGuard, subprocess wrapping, native telemetry, and approval support therefore vary by connector.
Integration families
Proxy connectors
OpenClaw, ZeptoClaw. Model requests routed through the DefenseClaw proxy and their responses are inspected; OpenClaw classifies recognized provider/request shapes, while ZeptoClaw rewrites configured provider api_base values.
Hook connectors
Claude Code, Codex, Amp, Cursor, Devin, GitHub Copilot CLI, OpenHands, Antigravity, Hermes, and OpenCode. DefenseClaw wires into the agent's native lifecycle hooks; the agent talks directly to its upstream.
Custom policy connector
OmniGent. DefenseClaw installs an in-process Python policy bridge and maps six awaited policy phases to ALLOW, ASK, or DENY without proxying model traffic.
Compatibility contracts
Versioned hook contracts, setup-time connector version checks, and the runtime hook_contract_lock.json.
One gateway, many hook connectors. A single DefenseClaw gateway can serve several hook connectors at once, each with its own guardrail posture under guardrail.connectors.<name> — pick Add (not Replace) when you run a second setup <connector>. Proxy connectors (OpenClaw, ZeptoClaw) bind a listener and own the traffic plane, so they can't be multi peers. See Multi-connector.
Pick yours
Platform support
Every connector page now keeps its macOS/Linux and native Windows setup in one place, including platform-specific paths, dependencies, and enforcement limits. Supported means the connector is available through the ordinary setup path; it does not invent official-client validation evidence when that evidence has not been recorded.
| Connector | macOS / Linux | Native Windows x64 | Important Windows boundary |
|---|---|---|---|
| Claude Code | Supported | Supported | Direct executable hooks; Git for Windows is optional and WSL is outside the native contract. |
| Codex | Supported | Supported | Event-bound system PowerShell bridge to the packaged hook executable plus native OTLP; no resumable native ask response. |
| Amp | Supported | Supported | Owner-only TypeScript system-policy plugin; no shell hook or native OTLP exporter. |
| Cursor | Supported | Supported | Managed PowerShell adapter; DefenseClaw does not enable Cursor's native ask response. |
| Devin | Supported | Supported | Exact same-user CLI 3000.4.25 admission; cloud Devin, ACP, proxy, and native OTLP are excluded. |
| GitHub Copilot CLI | Supported | Supported | Uses Copilot's PowerShell hook field; upstream Windows sandboxing cannot enforce per-path denials. |
| Antigravity | Supported | Supported | Native PowerShell launcher; only PreToolUse can block or ask. |
| Hermes | Supported | Supported | Direct executable hook is shell-free, but Hermes' own terminal tool depends on its bundled Git Bash. |
| OpenCode | Supported | Supported | Direct Windows execution is supported; only awaited tool.execute.before can block. |
| OmniGent | Supported | Supported — native degraded | Server/SDK policy path only; terminal wrappers and filesystem/network/L7 sandbox parity are unavailable. |
| OpenHands | Supported | Unsupported | OpenHands CLI requires WSL, and DefenseClaw has no WSL connector path. |
| OpenClaw | Supported | Unsupported | Its DefenseClaw integration requires the guardrail proxy, which native Windows does not host. |
| ZeptoClaw | Supported | Unsupported | Its DefenseClaw integration requires the guardrail proxy and upstream publishes macOS/Linux builds. |
Gemini CLI is deprecated and unavailable for new setup on every platform. Use Antigravity for new Google agent integration; the legacy Gemini CLI page exists only for safe, receipt-bound teardown.
Capability summary
| Family | Connectors | Data path | Enforcement boundary |
|---|---|---|---|
| Proxy | OpenClaw, ZeptoClaw | DefenseClaw receives and forwards model traffic | Request/response policy in the proxy |
| Hook | Claude Code, Codex, Amp, Cursor, Devin, GitHub Copilot CLI, OpenHands, Antigravity, Hermes, OpenCode | Agent remains connected directly to its upstream | Only the blocking events declared by that connector's selected hook contract; Cursor action uses event-native deny from its user hook |
| Custom policy | OmniGent | Agent remains connected directly to its upstream | Six in-process policy phases mapped to ALLOW, ASK, or DENY |
Native ask is event-specific: OpenClaw (before_tool_call), Claude Code
(PreToolUse), Copilot CLI (preToolUse), Antigravity (PreToolUse only),
Amp (tool.call and model-bound tool.result in the active foreground
thread), and OmniGent's three pre-action phases. DefenseClaw does not enable
Cursor's native ask response; Cursor confirm verdicts remain attributed
alerts. Other confirmation verdicts use the connector's documented fallback.
See the HITL reference for the canonical per-event matrix and
Connector Compatibility for exact version
ranges and script generations.
How a connector is structured
The interface is defined in internal/gateway/connector/connector.go; each per-connector file (claudecode.go, codex.go, cursor.go via hook_only.go, ...) implements it.
Enterprise hardening and deployment
Provision DefenseClaw as a managed operating-system service, understand its trust boundaries, and continuously repair per-user AI-agent hooks.
Connector Compatibility
Versioned hook contracts, setup-time compatibility checks, and the runtime hook contract lock for DefenseClaw connectors.