CiscoCiscoDefenseClaw
SetupGuardrail

Disabling guardrail

defenseclaw setup guardrail --disable rolls everything back. Connector hooks are removed (or restored from the byte-for-byte backup), the proxy stops, and the agent talks directly to its native upstream again.

defenseclaw setup guardrail --disable

This is the safe rollback. It runs the active connector's Teardown(), removes DefenseClaw-owned hook entries (or restores agent files from the hash-checked backup), stops the guardrail proxy, and clears the guardrail.enabled flag in ~/.defenseclaw/config.yaml.

--disable always restarts the gateway. Leaving the proxy running defeats the purpose of disabling.

What it touches

ConnectorRestored from backupSurgically removed if file drifted
Claude Code~/.claude/settings.json (hooks + OTEL_* env)DefenseClaw hook entries only
Codex~/.codex/config.toml (hooks, otel, notify)DefenseClaw blocks only
Cursor~/.cursor/hooks.jsonDefenseClaw hook entries only
Windsurf~/.codeium/windsurf/hooks.jsonDefenseClaw hook entries only
Gemini CLI~/.gemini/settings.jsonDefenseClaw hook entries + native OTLP block
GitHub Copilot CLI<workspace>/.github/hooks/defenseclaw.jsonDefenseClaw hook entries
Hermes~/.hermes/config.yamlDefenseClaw hook entries
OpenClaw~/.openclaw/openclaw.jsonPlugin allow/load entries
ZeptoClaw~/.zeptoclaw/config.json (api_base, safety)DefenseClaw rewrites

The audit DB and ~/.defenseclaw/ config are not removed. Use defenseclaw uninstall for the full reset.

Verify the rollback

defenseclaw doctor

doctor will confirm that no DefenseClaw hook scripts remain in the agent's config and that the gateway is offline (or running without the proxy listener bound).