Amp

DefenseClaw installs a dependency-free TypeScript policy plugin into Amp's user plugin directory, ~/.config/amp/plugins. Amp's docs call these system plugins, but they are per user, not machine-wide. The plugin sends session.start, agent.start, tool.call, tool.result and agent.end to the local gateway. Amp waits for tool.call before running the tool, and tool.result can replace unsafe output before the model sees it, so DefenseClaw can allow, reject or withhold, or ask through Amp's native UI. Result gating cannot undo side effects from a tool that already ran. The other three events provide lifecycle telemetry.

Amp talks to its own model provider directly. No proxy is involved and DefenseClaw does not proxy Amp's model traffic. See Amp's manual and plugin API.

On a per-user install, an explicitly saved guardrail.hook_fail_mode takes precedence over the selected tier. See the gateway outage table and Fail modes.

Platform support

Setup

On a new install, run defenseclaw init --connector amp first. Until DefenseClaw is initialized, defenseclaw setup amp stops with DefenseClaw is not initialized — run 'defenseclaw init' first.

defenseclaw setup amp                                  # first setup defaults to observe, global
defenseclaw setup amp --mode action                    # enforce calls and results
defenseclaw setup amp --workspace /path/to/repo        # also inventory the repository

A re-run without --mode keeps the current mode. On a terminal setup still asks for the mode, with the current one as the default (Enter keeps it), and whether to re-apply the hooks; in action mode it also asks whether to add the LLM judge. --yes skips the questions (the questions setup asks). On Windows, use a Windows path. The plugin is per user in every case.

--workspace sets the workspace for the whole DefenseClaw install, including Amp's project inventory. It inventories that repository's .amp/settings.json or .jsonc, .amp/plugins, skills, checks, guidance, MCP servers and custom agents. Use it on a single-Amp install: if it would move configured peer connectors to a different scope, setup refuses and changes nothing. On a multi-connector install, run defenseclaw setup amp without --workspace (and with no workspace pinned) for global protection. Global setup governs tool calls and inventories user and managed surfaces.

For headless runs, give Amp time to load plugins:

amp -x "your prompt" --plugin-ready-timeout 30

Without the flag a turn can begin before plugins load. The flag is needed for complete session and agent lifecycle capture, and for tool call and result guard readiness in execute mode. The three session and agent callbacks stay observe-only, and defenseclaw doctor reports this caveat alongside the installed plugin contract.

Check it

defenseclaw status

The agent appears under Agents with its mode. defenseclaw doctor reports no failed check for it.

Files it changes

The plugin holds a connector-scoped token. It is owner-only: private permissions, or the Windows user-only ACL. Setup keeps an existing file, teardown restores it, and a user-modified managed file is never silently removed. guardrail disable and connector removal refuse before saving while the bridge is modified. Preserve your edits, run defenseclaw setup amp --yes --restart, then retry.

Plugin lists, scans and the AIBOM treat the file as connector configuration, not as an operator plugin. defenseclaw plugin remove, disable, block and quarantine refuse defenseclaw --connector amp, because Amp runs unguarded without it. To stop guarding Amp, run defenseclaw setup remove amp.

The built-in admission.plugin.first_party_allow_list entry for defenseclaw matches the Amp bridge only at .config/amp/plugins/defenseclaw.ts. It does not trust sibling files or the whole Amp plugins directory. See first-party assets.

Lifecycle and enforcement

The contract is amp-plugin-v1, plugin script v2. DefenseClaw pins the normalized Amp build 0.0.1785334225 as its contract snapshot and certification floor. Amp does not declare that build as the upstream minimum.

Amp documents no session.end and no separate subagent events. Oracle, Task launchers, MCP tools and plugin-defined tools are governed at their parent tool.call. If Amp emits events from a child thread, DefenseClaw enforces that child's calls under its thread ID and invents no parent-child edge.

What it can block or ask

What a gateway outage does to an Amp call, per install and fail mode, is in the gateway outage table.

• tool.call runs before the tool. DefenseClaw can allow it, reject it or ask through Amp's confirmation UI.
• tool.result runs before the output reaches the model. DefenseClaw can keep it, withhold or replace it, or ask. It cannot undo a side effect.
• session.start, agent.start and agent.end are observed only.
• A prompt has no hook, so a matching prompt reaches the model. Tool-call rules still block.
• Ask works only for the active foreground thread. A background thread or missing UI rejects the call instead of allowing it.

Native ask

Amp can ask in the active foreground thread during tool.call and before a tool.result reaches the model. For a confirm decision, the plugin calls Amp's confirmation UI only when the thread is active in the foreground. Denial, a background thread or unavailable plugin UI rejects a pending call or withholds a pending result rather than allowing it silently.

Fail mode

Can fail closed: yes. On a per-user install with no saved mode, a gateway that is not running follows the policy tier: the default and permissive policies let the call run with one warning and a hook-failures.jsonl record, and the strict policy blocks it (gateway outage table). Every other per-user failure blocks the events that support a block response, and an unverified listener receives no bearer or event. Secure Client uses an administrator-owned native helper to verify the connected gateway service and blocks an unverified peer even when its outage mode is open. Settings and edge cases are in Fail modes. A per-user plugin runs the defenseclaw-gateway the install uses, also when it is installed outside ~/.local/bin, as long as its folder, the parent and the binary belong to this account and no other account can write them. When the helper's check of the connected listener fails before anything is sent, the plugin retries once. It never retries a call the gateway already took, so a tool call is evaluated once. A blocked call names the helper's own line or the refused answer, not a generic unverified-peer message. On Windows the plugin accepts the OWNER RIGHTS full-control entry that DefenseClaw writes on %USERPROFILE%\.defenseclaw.

Rejected command display

In the tested Amp 0.0.1790798464 build, a policy-rejected shell call can still have a checked, collapsed Ran 1 command summary. This counts an attempted tool call; the command did not execute. Expand the tool result to see Tool rejected by plugin and the DefenseClaw policy reason. The matching DefenseClaw audit block and absent command output confirm the rejection. The plugin sends Amp reject-and-continue with that reason before execution. Amp's plugin API does not provide a field for changing the collapsed summary.

MCP, skills, checks, plugins, and agents

Amp's local component surfaces are exposed without rewriting formats that DefenseClaw cannot preserve.

Agent 360, Galileo, and observability

Amp has no documented customer native-OTLP exporter and its plugin API gives no W3C traceparent. DefenseClaw produces canonical hook logs, metrics and spans from the five events, authenticated with the connector-scoped token.

Correlation uses only IDs Amp reports: the thread ID, the agent.start message ID, and toolUseID. Agent 360 discovers connector=amp and shows sessions, turns, tools, outcomes, approvals and enforcement attempts. Galileo receives only canonical spans that satisfy the galileo-rich-v2 profile. The plugin reports a custom agent's name, display label and declared model, or a built-in agent's mode, when available. That is not a stable agent ID, model request ID, trace context or parent link. Where a view needs an agent identity, DefenseClaw derives a per-session root identity and marks its lineage inferred. It never invents provider or model identity, request IDs, a trace parent or a parent-subagent link.

Local and remote execution boundary

Amp and DefenseClaw must run on the same host with the gateway reachable over loopback. Amp Orbs run remotely, do not load a local plugin and are not covered.

Hook capabilities

Amp has no hook that can stop a prompt, so a prompt rule doesn't block here: a matching prompt reaches the model. Tool-call rules still block (capability matrix).

In an OpenShell sandbox

The sandbox guide covers the sandbox commands. What the Amp image already holds:

Enterprise deployments

In an enterprise deployment the guardian writes the managed plugin into each enrolled user's ~/.config/amp/plugins/defenseclaw.ts (or %USERPROFILE%\.config\amp\plugins\defenseclaw.ts) and repairs it when the user changes it. Amp has no machine-wide plugin location, so coverage is advisory against a user who sets out to avoid it.

• Another config directory. Amp loads plugins from the amp/plugins folder under XDG_CONFIG_HOME (default ~/.config). A session started with XDG_CONFIG_HOME or HOME pointing elsewhere does not load the plugin (amp plugins list shows only Amp's own). Its tool calls are not inspected, and the guardian cannot repair that session. Managed status and verify now report a running relocated or unverified launch as incomplete and audit the observation. DEFENSECLAW_* overrides do not turn the plugin off.
• Plugin order. Amp does not define plugin order.

To reduce this, prefer agents DefenseClaw governs through machine policy (Claude Code, Codex, Cursor, GitHub Copilot, OpenCode). Use application control (fapolicyd on Linux, Santa or similar on macOS, WDAC or AppLocker on Windows) so users start Amp only through an administrator-owned launcher that resets XDG_CONFIG_HOME and HOME. A plugin that loaded stays closed when its DefenseClaw check fails: a killed or stopped check blocks the call.

See R1 and R3 in the threat model.

Limits

• Amp documents no session.end and no separate subagent events.
• Amp runs plugin code, including top-level code, when it loads. DefenseClaw does not sandbox that code, and Amp does not define the order of several plugins' handlers, so DefenseClaw cannot guarantee it sees another plugin's final input.
• Without --plugin-ready-timeout, a headless turn can start before the plugin loads, and no plugin can govern events before it loads.
• The plugin is in a folder you own. A session started with another XDG_CONFIG_HOME or HOME does not load it.
• Amp Orbs run remotely, load no local plugin and are not covered.
• Amp has no machine-wide plugin location, so enterprise coverage is advisory against a user who sets out to avoid it.
• Amp cannot run in an OpenShell sandbox yet.

Disable

For a per-user, single-connector install:

defenseclaw guardrail disable --yes

With the default gateway restart, disabling removes DefenseClaw's plugin file. This preserves your other Amp settings. defenseclaw guardrail enable reinstalls DefenseClaw's plugin. To remove the connector, run defenseclaw setup remove amp --yes (add --force if it is the last one). A modified bridge makes guardrail disable and setup remove refuse before saving configuration, and the gateway is left as it was; defenseclaw doctor reports the change. Preserve your edits, run defenseclaw setup amp --yes --restart, then retry. Relaunch Amp afterwards so every new thread starts without the removed plugin.

On a multi-connector install, add --connector amp to guardrail disable and guardrail enable to change only this agent:

defenseclaw guardrail disable --connector amp --yes