Install the plugin

One plugin, one local policy engine, one signed record. Pick your host. Node.js 22 on macOS or Linux; Windows execution is not verified.

Claude Code

1. Add the marketplace and install.

   claude plugin marketplace add MerchantGuard/agentguard-codex-plugin
   claude plugin install agentguard@agentguard

2. Provision the locked dependencies in the plugin root Claude Code reports. Lifecycle scripts must be enabled for this step.

   npm ci

3. Complete the normal marketplace installation and workspace trust prompts. The /hooks menu in Claude Code is read-only: inspect the configured plugin hooks there.
4. Check the effective mode with the agentguard-status skill. A configured enforce policy stays in shadow until a usable license is present.

Codex and ChatGPT Work

1. Add the marketplace and install.

   codex plugin marketplace add MerchantGuard/agentguard-codex-plugin
   codex plugin add agentguard@agentguard

2. Change into the installed plugin root Codex reports and provision the locked dependencies.

   npm ci

3. Start a new session, open /hooks, inspect the startup command, both tool gates, the receipt command and the session-end command, then trust the reviewed definitions. Installing a plugin does not trust its hooks.
4. Check the effective mode with the agentguard-status skill.

What you just installed

Locked dependencies are the published @agentguard-run/spend ^0.20.0 and @agentguard-run/burn ^0.2.3, with no sibling links. Hooks talk through a private filesystem mailbox and never open a socket. Provisioning may access npm. Run npm ci again after a lockfile change.

What a block looks like

A real session on Sep 19 2026. Sixteen spawns in fifteen active minutes. Recorded with a prepared session; the decision is real.

The free install runs in shadow mode: every decision is signed and recorded, no tool call is blocked. A paid license turns on enforce mode. See Free and paid.

Host notes

Claude Code

Claude Code installs locked Node dependencies when it caches a Git marketplace plugin, with lifecycle scripts disabled. A local-directory marketplace does not install dependencies automatically. Run the explicit npm ci step with lifecycle scripts enabled so the plugin can prepare its runtime.

Codex and ChatGPT Work

The public marketplace points at compat/codex-0.154/agentguard. Codex 0.154 skips portable hook sources, so installing the portable root directly can expose MCP tools without running the hooks. Compatibility hooks return an empty success response for unchanged allowed input, as that release’s parser requires. Denials and signed decisions keep their values.

In a Codex cache installation, postinstall also provisions the locked dependencies in the persistent plugin data directory, because Codex 0.154 can replace its install cache at session start. For a managed installation, set PLUGIN_DATA to the intended private runtime directory during provisioning.

Trust is pinned to each normalized hook definition. Changed definitions need review again. User hooks can take precedence over conflicting plugin decisions, and other matching hooks can run alongside these.

Private workspace marketplace

A firm can distribute its reviewed copy through .agents/plugins/marketplace.json, pointing the plugin entry at the compatibility installation. A marketplace named firm uses the selector agentguard@firm. In a supported desktop surface, select the marketplace in the Plugins Directory and install in a new chat. Node, scripts and dependencies must exist wherever Work executes them. A public repository is not a directory submission; workspace-wide publication is a separate administrator action.

How a tool call is decidedHook, policy, decision, signed receipt. What is covered and what is not.

Enterprise installationReviewed trust through config, managed hooks through MDM.