defenseclaw setup guardrail

defenseclaw setup guardrail is the operator command. It picks the connector, picks the mode, points the scanners at the right backend, optionally enables the LLM judge, and configures human-in-the-loop. Every other setup verb in DefenseClaw is a thin wrapper around this one.

Watch the interactive flow

The animation below replays a real defenseclaw setup guardrail session — connector pick, integration mode, observe vs action, hook fail-mode, scanner backend, judge, advanced options, and the final summary. Hover or press Pause to study a frame; press Restart to replay.

Same setup, no prompts

Every choice the wizard makes has a flag (with a couple of documented exceptions, below). The CI-friendly equivalent of the demo above is one command:

defenseclaw setup guardrail \
  --non-interactive \
  --connector claudecode \
  --mode observe \
  --scanner-mode local \
  --detection-strategy regex_only \
  --restart

Pass --non-interactive (or --accept-defaults) to skip every prompt; missing flags fall back to the same defaults the wizard would have offered. The judge stays off until you pass --judge-model (or pick a strategy that uses it); --detection-strategy regex_only here just makes that explicit.

Prompt → flag mapping

Each row corresponds to one prompt in the animation. Default shows what pressing Enter selects; Flag is the CI-shaped equivalent. Rows tagged interactive-only have no direct flag — the Note explains the workaround.

On a multi-connector install, --connector <name> scopes this setup run to that connector. When --block-message is supplied without --connector, setup treats it as broad operator intent: it updates the shared block message and reconciles active connector overrides so one connector does not keep stale block text.

Two modes you have to choose between

Connector resolution

When you omit --connector, DefenseClaw resolves it in this order:

1. --connector flag (operator intent always wins)
2. Existing guardrail.connector if you have run setup before
3. <data_dir>/picked_connector hint written by scripts/install.sh --connector ...
4. Filesystem auto-detection (only in interactive mode)
5. Fallback to openclaw

Tabs by mode (non-interactive recipes)

defenseclaw setup guardrail \
  --non-interactive \
  --connector claudecode \
  --mode observe \
  --scanner-mode local \
  --restart

defenseclaw setup guardrail \
  --non-interactive \
  --connector claudecode \
  --mode action \
  --scanner-mode local \
  --rule-pack default \
  --restart

defenseclaw setup guardrail \
  --non-interactive \
  --connector claudecode \
  --mode action \
  --rule-pack default \
  --human-approval \
  --hilt-min-severity high \
  --restart

export DEFENSECLAW_LLM_KEY='replace-with-your-key'

defenseclaw setup guardrail \
  --non-interactive \
  --connector claudecode \
  --mode action \
  --detection-strategy regex_judge \
  --judge-model anthropic/claude-sonnet-4-20250514 \
  --judge-api-key-env DEFENSECLAW_LLM_KEY \
  --restart

defenseclaw setup guardrail \
  --non-interactive \
  --connector claudecode \
  --mode action \
  --detection-strategy regex_judge \
  --judge-provider bedrock \
  --judge-model us.anthropic.claude-sonnet-4-6 \
  --judge-bedrock-region us-east-1 \
  --judge-bedrock-auth-mode iam_credentials \
  --judge-bedrock-access-key-env AWS_ACCESS_KEY_ID \
  --judge-bedrock-secret-key-env AWS_SECRET_ACCESS_KEY \
  --judge-bedrock-inference-profile us. \
  --restart

Every flag

What setup writes

A hash-checked backup is stored before edits; teardown restores or surgically removes only DefenseClaw-owned entries. See the per-connector pages for the exact files mutated for each agent.

Verify it worked

defenseclaw doctor
defenseclaw status
defenseclaw alerts --limit 25

doctor prints the full health report. status shows enforcement flags plus a per-connector block for every active connector (it has no flags of its own — it always reports the full Agents roster from config and /health, identical layout whether one or N connectors are wired). alerts lists recent decisions as a table; pass --connector <name> to filter by connector attribution and --show <n> to expand a specific row. For a live stream, open defenseclaw tui (interactive) or tail -f ~/.defenseclaw/gateway.jsonl | jq (scripted).

Interactive vs non-interactive — every command

DefenseClaw is interactive-first. When you run a setup or init verb at a terminal, you get a wizard with sane defaults and inline help. The same commands accept flags for unattended runs.

The matrix below is the source of truth. ✓ means "supported"; ✗ means "not supported on this command — see Notes for the workaround". A blank cell in the Notes column means there's no asymmetry worth flagging.

Common follow-ups

Add vs Replace: keeping more than one connector wired

When you run a hook setup (defenseclaw setup codex, setup claude-code, …) and a different connector is already wired, DefenseClaw asks whether to Add or Replace:

• Add — keep the existing connector(s) and layer the new one in. The gateway now enforces guardrail policy for both, each under its own guardrail.connectors.<name> block, and claw.mode flips to multi. This is the multi-connector path.
• Replace — tear down the previous connector's wiring and make the new one the single active connector (documented in Changing connectors).

Proxy connectors (OpenClaw, ZeptoClaw) can't be Add peers — they own the traffic plane, so only one runs at a time.