openclaw-jev-leakguard
OpenClaw plugin that checks each outgoing agent message against its destination and blocks client names, credentials or internal hosts.
Overview
Leakguard is an OpenClaw plugin that judges an outgoing agent message together with where it is going. It was motivated by an agent posting a status update in a vendor-shared channel that named a client, its domain and the build-server path holding that client's credentials, with nothing a secret scanner would catch. Destinations are mapped to tiers such as private, shared and public.
Local rules check key formats and configured terms first; then five Jev Noul questions in one call ask whether the message contains a credential, where credentials are kept, a client name, internal infrastructure or confidential business information. Calls go through OpenClaw's decisionModel, so hosted Jev or a local Kev can judge. Depending on the tier and probabilities, the plugin blocks, asks or holds the message. A gateway call lets you test a message directly. It requires OpenClaw 2026.9.6+.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does the message contain a credential? | yes · no |
| Yes / no | Does it reveal where credentials are kept? | yes · no |
| Yes / no | Does it name a client? | yes · no |
| Yes / no | Does it expose internal infrastructure or confidential business information? | yes · no |
How it works
- Agent prepares a message for a destination.
- Apply local key-format and term rules.
- Ask five Noul questions in one decisionModel call.
- Block, ask or hold according to destination tier and probabilities.
Strengths
- Catches context-dependent leaks secret scanners miss.
- Works with hosted Jev or local Kev.
- Destination-aware policy.
Caveats
- Requires OpenClaw 2026.9.6+.
- Judgments are probabilistic; tune thresholds per tier.
Getting started
openclaw plugins install git:github.com/yousan/openclaw-jev-leakguard --accept-capabilities, configure terms and destinations, then openclaw gateway restart.At a glance
- Type
- Plugin
- Status
- beta
- Language
- TypeScript
- Runtime
- OpenClaw plugin
- Has code
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Agent security: OpenClaw plugin that checks every outgoing agent message against where it is going, running local key-format and term rules and then five Jev `Noul` questions in one call (credential, where credentials are kept, client name, internal infrastructure, confidential business information) through OpenClaw's `decisionModel`, hosted Jev or a local Kev, and blocking, asking or holding it back by the channel's public, shared or private tier; with Jev it missed 0 of 56 synthetic leaks, 30 of which no regex or term list could see, with 4 false alarms on 57 ordinary messages at 223 ms p50.
yibie/awesome-jev
Frequently asked questions
What does Leakguard check?
Whether a message leaks credentials, their location, client names, internal infrastructure or confidential information to the wrong destination.
Can I run it locally?
Yes, use a local Kev as OpenClaw's decisionModel.
Why consider the destination?
The same sentence can be fine in a private channel and harmful in a shared one.
Related projects
Safety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScriptClaude Code mod that answers auto mode's tool-call permission question with eight Jev yes/no checks behind a shell-aware blocklist.
ProjectbetaTypeScriptRing Zero: kernel-level runtime security for AI agents, with Jev as an optional check that can only raise severity, never permit.
ServicebetaClaude Code hook that blocks known key formats locally and sends unknown high-entropy strings to Jev only in masked form.
HookbetaPythonClaude Code hook where Jev reviews each tool call against risk, authorization and scope questions and a local policy returns allow or deny.
ProjectbetaGoOpenCode 2 plugin that asks Jev six questions about every shell command (local or remote via FarHand) and prompts unless clearly safe.
MCP serverbetaTypeScript