Connectors

Connectors

Thirteen active connectors share one adapter interface while exposing connector-specific proxy, hook, policy, telemetry, and approval capabilities.

Connectors are the adapter layer between agent frameworks and DefenseClaw. They share one Go interface, but each connector advertises only the capabilities its agent actually exposes. Proxy routing, lifecycle hooks, custom policy callbacks, component discovery, CodeGuard, subprocess wrapping, native telemetry, and approval support therefore vary by connector.

Integration families

Proxy connectors

OpenClaw, ZeptoClaw. Model requests routed through the DefenseClaw proxy and their responses are inspected; OpenClaw classifies recognized provider/request shapes, while ZeptoClaw rewrites configured provider api_base values.

Hook connectors

Claude Code, Codex, Amp, Cursor, Devin, GitHub Copilot CLI, OpenHands, Antigravity, Hermes, and OpenCode. DefenseClaw wires into the agent's native lifecycle hooks; the agent talks directly to its upstream.

Custom policy connector

OmniGent. DefenseClaw installs an in-process Python policy bridge and maps six awaited policy phases to ALLOW, ASK, or DENY without proxying model traffic.

Compatibility contracts

Versioned hook contracts, setup-time connector version checks, and the runtime hook_contract_lock.json.

One gateway, many hook connectors. A single DefenseClaw gateway can serve several hook connectors at once, each with its own guardrail posture under guardrail.connectors.<name> — pick Add (not Replace) when you run a second setup <connector>. Proxy connectors (OpenClaw, ZeptoClaw) bind a listener and own the traffic plane, so they can't be multi peers. See Multi-connector.

Pick yours

Platform support

Every connector page now keeps its macOS/Linux and native Windows setup in one place, including platform-specific paths, dependencies, and enforcement limits. Supported means the connector is available through the ordinary setup path; it does not invent official-client validation evidence when that evidence has not been recorded.

ConnectormacOS / LinuxNative Windows x64Important Windows boundary
Claude CodeSupportedSupportedDirect executable hooks; Git for Windows is optional and WSL is outside the native contract.
CodexSupportedSupportedEvent-bound system PowerShell bridge to the packaged hook executable plus native OTLP; no resumable native ask response.
AmpSupportedSupportedOwner-only TypeScript system-policy plugin; no shell hook or native OTLP exporter.
CursorSupportedSupportedManaged PowerShell adapter; DefenseClaw does not enable Cursor's native ask response.
DevinSupportedSupportedExact same-user CLI 3000.4.25 admission; cloud Devin, ACP, proxy, and native OTLP are excluded.
GitHub Copilot CLISupportedSupportedUses Copilot's PowerShell hook field; upstream Windows sandboxing cannot enforce per-path denials.
AntigravitySupportedSupportedNative PowerShell launcher; only PreToolUse can block or ask.
HermesSupportedSupportedDirect executable hook is shell-free, but Hermes' own terminal tool depends on its bundled Git Bash.
OpenCodeSupportedSupportedDirect Windows execution is supported; only awaited tool.execute.before can block.
OmniGentSupportedSupported — native degradedServer/SDK policy path only; terminal wrappers and filesystem/network/L7 sandbox parity are unavailable.
OpenHandsSupportedUnsupportedOpenHands CLI requires WSL, and DefenseClaw has no WSL connector path.
OpenClawSupportedUnsupportedIts DefenseClaw integration requires the guardrail proxy, which native Windows does not host.
ZeptoClawSupportedUnsupportedIts DefenseClaw integration requires the guardrail proxy and upstream publishes macOS/Linux builds.

Gemini CLI is deprecated and unavailable for new setup on every platform. Use Antigravity for new Google agent integration; the legacy Gemini CLI page exists only for safe, receipt-bound teardown.

Capability summary

FamilyConnectorsData pathEnforcement boundary
ProxyOpenClaw, ZeptoClawDefenseClaw receives and forwards model trafficRequest/response policy in the proxy
HookClaude Code, Codex, Amp, Cursor, Devin, GitHub Copilot CLI, OpenHands, Antigravity, Hermes, OpenCodeAgent remains connected directly to its upstreamOnly the blocking events declared by that connector's selected hook contract; Cursor action uses event-native deny from its user hook
Custom policyOmniGentAgent remains connected directly to its upstreamSix in-process policy phases mapped to ALLOW, ASK, or DENY

Native ask is event-specific: OpenClaw (before_tool_call), Claude Code (PreToolUse), Copilot CLI (preToolUse), Antigravity (PreToolUse only), Amp (tool.call and model-bound tool.result in the active foreground thread), and OmniGent's three pre-action phases. DefenseClaw does not enable Cursor's native ask response; Cursor confirm verdicts remain attributed alerts. Other confirmation verdicts use the connector's documented fallback. See the HITL reference for the canonical per-event matrix and Connector Compatibility for exact version ranges and script generations.

How a connector is structured

ConnectorSetup(ctx, opts)write hook scripts,back up agent files,register routes
ConnectorAuthenticate(r)verify gateway token
ConnectorRoute(r, body)extract upstream + model+ stream + headers
ConnectorTeardown(ctx, opts)restore agent files
ConnectorVerifyClean(opts)no residual artifacts
Every connector implements the same Go interface; individual methods may report that an agent does not support that capability.

The interface is defined in internal/gateway/connector/connector.go; each per-connector file (claudecode.go, codex.go, cursor.go via hook_only.go, ...) implements it.