Quick setup aliases

defenseclaw setup codex, setup claude-code, setup cursor, setup copilot, setup openhands, setup antigravity, setup hermes, setup opencode, setup amp, setup omnigent, setup geminicli, setup windsurf, setup openclaw, setup zeptoclaw — one connector-oriented command per agent.

Each connector has a setup alias that selects the corresponding setup guardrail --connector <name> posture while exposing a smaller, connector-oriented flag surface. Use them for fast subsequent runs; pass the documented non-interactive flags in CI.

Direct-to-upstream aliases (hook or policy enforcement)

These connectors talk directly to their native upstream, so DefenseClaw never proxies model traffic. Observe mode records telemetry; action mode returns supported agent-native hook verdicts, Amp's synchronous pre-execution tool.call and model-bound tool.result allow/reject decisions, or OmniGent's native ALLOW / ASK / DENY policy decisions. Amp native confirmation is available only in the active foreground thread; background confirmation falls back to safe rejection or withholding.

Codex

defenseclaw setup codex

Claude Code

defenseclaw setup claude-code

Cursor

defenseclaw setup cursor

Windsurf

defenseclaw setup windsurf

Gemini CLI

defenseclaw setup geminicli

GitHub Copilot CLI

defenseclaw setup copilot

OpenHands

defenseclaw setup openhands

Antigravity

defenseclaw setup antigravity

Hermes

defenseclaw setup hermes

OpenCode

defenseclaw setup opencode

Amp

defenseclaw setup amp — synchronous pre-execution and model-bound result policy, with foreground native confirmation

OmniGent

defenseclaw setup omnigent — custom policy bridge with native ALLOW / ASK / DENY

defenseclaw setup claude-code
defenseclaw setup codex --with-local-stack   # also brings up Prom/Loki/Tempo/Grafana
defenseclaw setup cursor --no-restart        # apply config without bouncing the gateway

These aliases are shorthand for setup guardrail --connector <name> with connector-specific options. On a single-connector host that connector is the active posture. On a host with another hook or policy connector already active, choose Add to keep both connectors wired under guardrail.connectors and let claw.mode become multi.

What a direct-to-upstream alias does

Selects the target connector exactly as if you had passed defenseclaw setup guardrail --connector <name>.

Wires the connector's documented hook, Amp plugin, or OmniGent policy surface and, where supported, native OTel exporter settings. No proxy listener binds; the agent talks directly to its native upstream.

Uses observe mode by default. With --mode action, supported lifecycle callbacks return native block/approval decisions; Amp synchronously governs pre-execution tool.call and every model-bound tool.result, with native confirmation limited to the active foreground thread, and OmniGent maps all six policy phases to ALLOW, ASK, or DENY.

Persists config.yaml, updates the active connector roster, and writes the picked_connector hint for compatibility with flows that still need a default selection. On multi-connector hosts, use explicit --connector <name> whenever you mean to scope a later command to one connector.

Restarts the gateway (unless --no-restart).

Common flags

Prop

Type

Port 3000 is the current local-stack preflight

--with-local-stack treats any TCP listener on 127.0.0.1:3000 as an already-running stack and skips local-observability up, including its destination wiring. If the bundled stack or expected destination is absent, run defenseclaw setup local-observability up explicitly and follow the printed defenseclaw-gateway restart step.

Full guardrail aliases (proxy connectors)

OpenClaw and ZeptoClaw run the full guardrail proxy regardless of mode — there is no observability-only path because the proxy is the integration. Their aliases mirror defenseclaw setup guardrail --connector <name> with safer defaults.

OpenClaw

defenseclaw setup openclaw

ZeptoClaw

defenseclaw setup zeptoclaw

defenseclaw setup openclaw --mode observe --restart
defenseclaw setup openclaw --mode action --human-approval --rule-pack default --restart

Add or reconfigure connectors

Use defenseclaw setup <connector> to add or reconfigure that connector. On hosts that already have another connector wired, the interactive flow asks whether to add the connector alongside the existing one or replace the old wiring. Use defenseclaw setup remove <connector> when you want to retire a connector.

Why aliases at all?

Operators previously walked through the full setup guardrail wizard just to configure one connector. The aliases expose the common observe/action path directly:

defenseclaw setup codex                         # observe by default
defenseclaw setup claude-code --mode action    # native lifecycle verdicts
defenseclaw setup amp --mode action            # tool execution + model-bound result enforcement
defenseclaw setup omnigent --mode action       # native ALLOW / ASK / DENY policy
defenseclaw setup openclaw       # full guardrail for OpenClaw

Both halves are really --connector shortcuts. That matters after setup too: defenseclaw skill list --connector codex, defenseclaw mcp scan --connector cursor, and defenseclaw guardrail status --connector hermes all use the same connector scope instead of relying on a single global "current connector" mental model.