Is agentsocks command protection active by default?

External · opt-in: External coverage. It must be enabled through Guard controls; this page does not activate it. Enabling state is always controlled through Guard policy, never from this directory.

Who maintains agentsocks command protection?

This listing entered the catalog as a community contribution through a public pull request with recorded provenance, with public credit to @DarkStar616, and 1 GitHub maintainer is recorded on the listing. Credit is attribution only. A verified publisher profile and the claim flow verify authority separately; neither is an upstream endorsement or a HOL safety certification.

Is a listing of agentsocks command protection a security guarantee?

No. Every listing documents source, activation model, maintainer identity, and stated limitations so you can evaluate coverage before enabling it. Review the stated limitations and the exact source tree before relying on any single control.

Which commands does agentsocks command protection allow or review by default?

10 operations · 10 reviewed by default. Examples: agentsocks gateway public --via funnel --yes (reviewed by default); agentsocks peer add grok --api xai --key-file ~/xai.env --may-message api-worker (reviewed by default); agentsocks gateway token add grok --may-message api-worker (reviewed by default); agentsocks gateway on --serve (reviewed by default); agentsocks install --codex (reviewed by default); agentsocks link hetzner-lab (reviewed by default); agentsocks classifier jev --key-file ~/typesafe.env (reviewed by default); agentsocks send api-worker 'the migration is done' (reviewed by default). The remaining 2 operations are listed in the command mapping table. These are catalog defaults, not your workspace policy.

How do I enable or disable agentsocks command protection?

External coverage. It must be enabled through Guard controls; this page does not activate it. Enablement is managed through your workspace's Guard policy and controls — never from this directory. Open the install guidance for the setup flow, then adjust the command coverage for command.agentsocks in Guard's policy surface.

What happens when agentsocks command protection blocks a command?

The matching action is stopped at Guard's pre-action boundary before it executes, and the decision is recorded with evidence your workspace can review. Exact behavior follows your Guard policy combined with this entry's 10 rules and 10 permission checks.

Does evaluating agentsocks command protection send my data anywhere?

No. Guard is local-first: interception, decisions, and evidence stay on your machine unless your workspace explicitly configures cloud features. This page is documentation only — it never executes a command or changes protection state.

Which AI coding agents does agentsocks command protection work with?

Guard runs locally alongside the major AI coding agents and MCP-capable harnesses, so this coverage applies wherever Guard intercepts actions. See the supported harness guides at https://hol.org/guard/harnesses for per-tool approval behavior and limitations.

How much does Guard cost?

Guard has a free local tier that includes command interception, evidence, and the policy controls this listing documents. Team plans add shared policy, review queues, and audit surfaces. Current plans: https://hol.org/guard/pricing

How do I report an incorrect or outdated agentsocks command protection listing?

Open an issue or pull request against the hol-guard repository, where the canonical catalog lives: https://github.com/hashgraph-online/hol-guard Listings are corrected through the same public review process that adds them.

Can I get coverage for my own tool?

Yes. Community extensions are merged through public pull requests with recorded provenance, and you can claim the publisher page for a contribution you maintain through the Publisher Studio.

How do I audit what agentsocks command protection actually enforces?

The command mapping table is the audit trail for covered commands and catalog default floors. Pair it with the reviewed rule and permission counts, the per-tool state mapping, and the exact source tree linked from View exact source at the reviewed commit. Guard records enforcement decisions with evidence locally, so what ships matches what you reviewed.

agentsocks command protection

Reviews agentsocks commands that edit agent configuration and hooks, message other agent sessions, bind a driver, send message text to a rem

Reviews agentsocks commands that edit agent configuration and hooks, message other agent sessions, bind a driver, send message text to a remote classifier, start or expose the gateway, issue gateway tokens and access, link another machine, or add a paid API peer. Read-only commands such as list, status, stats, doctor, whoami, channels, tasks and top are not matched. Based on agentsocks 0.4.0.

command.agentsocks · v1.0.0 · Other extensions

By Community contributorExternal · opt-inCommand coverage

Try this coverage Install GuardView exact source agentsocks command protection documentation Claim this coverage

Protection rules: 10
Permission checks: 10
Mapped commands: 10

Overview

What this coverage does

Key facts

Catalog ID: command.agentsocks
Version: v1.0.0
Kind: Command coverage
Category: Other extensions
Protection rules: 10
Permission checks: 10
Mapped commands: 10
Maintainer: Community contributor(community, provenance recorded)
Source commit: e2593fe
Protection model: External · opt-in

External · opt-in

External coverage. It must be enabled through Guard controls; this page does not activate it.

Stated limits

Coverage is limited to the reviewed operations and the surrounding Guard policy.
A maintainer profile is not a security certification or an official upstream endorsement.

Command mapping

Every command this extension recognizes, with the catalog default floor Guard applies before workspace policy. Search the table, then open an operation for safe variants and the permission ID.

10 operations · 10 reviewed by default These are catalog defaults, not your workspace policy.

10 operations10 reviewed

Find a command

Default floor

Showing 10 of 10 operations

Commands this extension covers and their catalog default floors
Commands	Default	Severity	Operation
`agentsocks gateway public --via funnel --yes`	Reviewed Guard intercepts the command for review before it runs.	Critical	agentsocks public gateway Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks gateway public`, which starts a second listener for ChatGPT, Grok and other remote clients that authenticate with a bearer token or OAuth. It stays on 127.0.0.1 until the printed `tailscale funnel` or `cloudflared` command exposes it to the internet, and `--yes` runs the funnel command. Documented safe variants `agentsocks public gateway offagentsocks command helpagentsocks command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.gateway-public
`agentsocks peer add grok --api xai --key-file ~/xai.env --may-message api-worker`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks API peer Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks peer add`, which makes a model behind the xAI or OpenAI API a peer. When a message arrives, the broker calls the provider with the key read from `--key-file`; each answer takes one to six paid calls, capped by `--max-calls-per-hour` (30 by default), and what is sent to the peer goes to the provider. Documented safe variants `agentsocks command helpagentsocks command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.add-api-peer
`agentsocks gateway token add grok --may-message api-worker`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks gateway access Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks gateway token add`, which creates a bearer token for a remote peer; `gateway pair`, which prints the one-time code that lets ChatGPT complete OAuth consent; `gateway may`, which sets the session names a remote peer may message (`*` means every session); and `gateway allow`, which lets another machine or tailnet user use the gateway. Documented safe variants `agentsocks gateway command helpagentsocks gateway command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.gateway-access
`agentsocks gateway on --serve`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks gateway listener Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks gateway on`, which starts the gateway listener on 127.0.0.1 and prints the `tailscale serve` command that puts it on the owner's tailnet. `--serve` runs that command, and `--allow-unverified-local-source` starts the gateway where the source of a connection cannot be checked. Documented safe variants `agentsocks command helpagentsocks command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.gateway-listen
`agentsocks install --codex`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks agent installation Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks install`, which registers the agentsocks MCP server with Claude Code and Codex, adds hooks to Codex, and wires any other supported agent it finds. It edits those agents' configuration files, keeping backups, and marks the Codex hooks as trusted unless `--no-trust-hooks` is given. `--claude-listagents` also lets the broker write records into Claude Code's session registry. `… Documented safe variants `agentsocks install dry runagentsocks command helpagentsocks command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.install
`agentsocks link hetzner-lab`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks machine link Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks link <host>`, which links this machine's broker to another machine's gateway so that machine's sessions appear here as `name@host` and messages can be forwarded to them. The other machine must have run `gateway allow` for this one. `link --remove <host>` undoes a link and is not matched; a bare `link`, which lists links, is reviewed too. Documented safe variants `agentsocks link removalagentsocks command helpagentsocks command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.link-machine
`agentsocks classifier jev --key-file ~/typesafe.env`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks remote classifier Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies commands that make agentsocks send message text to a classifier: `agentsocks classifier jev`, which turns on hosted TypeSafe Jev at api.typesafe.ai and can store its API key; `agentsocks classifier local <url> --allow-remote`, which allows a classifier on another host; and `agentsocks eval-router --own --allow-remote`, which replays rated messages through a classifier that is not on th… Documented safe variants `agentsocks classifier command helpagentsocks classifier command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.remote-classifier
`agentsocks send api-worker 'the migration is done'`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks session message Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks send`, which delivers a message to another agent session, to a `#channel`, or to a linked machine's session (`name@host`). The receiving agent reads the text through its own inbox, and a message cannot approve a permission prompt. When a remote peer or an API model peer is configured, the text can reach that peer and its provider as well. Documented safe variants `agentsocks command helpagentsocks command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.send-message
`agentsocks driver api-worker`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks driver binding Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks driver`, which names the session whose instructions this session follows. The driver's messages reach the worker as instructions and everyone else's arrive as information only. The binding is coordination between one user's sessions, not a boundary. Documented safe variants `agentsocks driver clearagentsocks command helpagentsocks command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.set-driver
`agentsocks uninstall`	Reviewed Guard intercepts the command for review before it runs.	High	agentsocks agent uninstallation Default floor Reviewed by default. Guard intercepts the command for review before it runs. Detector mode review What it matches Identifies `agentsocks uninstall`, which removes the agentsocks registrations and hooks from the agents' configuration files (backups are kept), stops the running broker, and revokes every gateway token, grant and API peer while archiving the gateway state. `--dry-run` shows what would be removed. Documented safe variants `agentsocks uninstall dry runagentsocks command helpagentsocks command short help`skip this operation when they are the documented preview or help form. Permission ID command.agentsocks.permission.uninstall

Reviewed Guard intercepts the command for review before it runs.Critical
- agentsocks gateway public --via funnel --yes
agentsocks public gateway
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks gateway public`, which starts a second listener for ChatGPT, Grok and other remote clients that authenticate with a bearer token or OAuth. It stays on 127.0.0.1 until the printed `tailscale funnel` or `cloudflared` command exposes it to the internet, and `--yes` runs the funnel command.
Documented safe variants
agentsocks public gateway offagentsocks command helpagentsocks command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.gateway-public
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks peer add grok --api xai --key-file ~/xai.env --may-message api-worker
agentsocks API peer
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks peer add`, which makes a model behind the xAI or OpenAI API a peer. When a message arrives, the broker calls the provider with the key read from `--key-file`; each answer takes one to six paid calls, capped by `--max-calls-per-hour` (30 by default), and what is sent to the peer goes to the provider.
Documented safe variants
agentsocks command helpagentsocks command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.add-api-peer
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks gateway token add grok --may-message api-worker
agentsocks gateway access
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks gateway token add`, which creates a bearer token for a remote peer; `gateway pair`, which prints the one-time code that lets ChatGPT complete OAuth consent; `gateway may`, which sets the session names a remote peer may message (`*` means every session); and `gateway allow`, which lets another machine or tailnet user use the gateway.
Documented safe variants
agentsocks gateway command helpagentsocks gateway command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.gateway-access
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks gateway on --serve
agentsocks gateway listener
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks gateway on`, which starts the gateway listener on 127.0.0.1 and prints the `tailscale serve` command that puts it on the owner's tailnet. `--serve` runs that command, and `--allow-unverified-local-source` starts the gateway where the source of a connection cannot be checked.
Documented safe variants
agentsocks command helpagentsocks command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.gateway-listen
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks install --codex
agentsocks agent installation
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks install`, which registers the agentsocks MCP server with Claude Code and Codex, adds hooks to Codex, and wires any other supported agent it finds. It edits those agents' configuration files, keeping backups, and marks the Codex hooks as trusted unless `--no-trust-hooks` is given. `--claude-listagents` also lets the broker write records into Claude Code's session registry. `…
Documented safe variants
agentsocks install dry runagentsocks command helpagentsocks command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.install
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks link hetzner-lab
agentsocks machine link
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks link <host>`, which links this machine's broker to another machine's gateway so that machine's sessions appear here as `name@host` and messages can be forwarded to them. The other machine must have run `gateway allow` for this one. `link --remove <host>` undoes a link and is not matched; a bare `link`, which lists links, is reviewed too.
Documented safe variants
agentsocks link removalagentsocks command helpagentsocks command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.link-machine
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks classifier jev --key-file ~/typesafe.env
agentsocks remote classifier
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies commands that make agentsocks send message text to a classifier: `agentsocks classifier jev`, which turns on hosted TypeSafe Jev at api.typesafe.ai and can store its API key; `agentsocks classifier local <url> --allow-remote`, which allows a classifier on another host; and `agentsocks eval-router --own --allow-remote`, which replays rated messages through a classifier that is not on th…
Documented safe variants
agentsocks classifier command helpagentsocks classifier command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.remote-classifier
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks send api-worker 'the migration is done'
agentsocks session message
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks send`, which delivers a message to another agent session, to a `#channel`, or to a linked machine's session (`name@host`). The receiving agent reads the text through its own inbox, and a message cannot approve a permission prompt. When a remote peer or an API model peer is configured, the text can reach that peer and its provider as well.
Documented safe variants
agentsocks command helpagentsocks command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.send-message
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks driver api-worker
agentsocks driver binding
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks driver`, which names the session whose instructions this session follows. The driver's messages reach the worker as instructions and everyone else's arrive as information only. The binding is coordination between one user's sessions, not a boundary.
Documented safe variants
agentsocks driver clearagentsocks command helpagentsocks command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.set-driver
Reviewed Guard intercepts the command for review before it runs.High
- agentsocks uninstall
agentsocks agent uninstallation
Default floor
Reviewed by default. Guard intercepts the command for review before it runs.
Detector mode
review
What it matches
Identifies `agentsocks uninstall`, which removes the agentsocks registrations and hooks from the agents' configuration files (backups are kept), stops the running broker, and revokes every gateway token, grant and API peer while archiving the gateway state. `--dry-run` shows what would be removed.
Documented safe variants
agentsocks uninstall dry runagentsocks command helpagentsocks command short helpskip this operation when they are the documented preview or help form.
Permission ID
command.agentsocks.permission.uninstall

Tool state mapping

No per-tool overrides are declared. Command defaults above resolve through the workspace Guard policy unless a later policy layer changes them.

Runtime identity

Catalog ID: command.agentsocks
Guard enforcement ID: command.agentsocks
Source path: contributions/extensions/command.agentsocks.json
Contribution digest: sha256…33890f

Action classes

agentsocks API peer commandagentsocks agent installation commandagentsocks agent uninstallation commandagentsocks driver binding commandagentsocks gateway access commandagentsocks gateway listener commandagentsocks machine link commandagentsocks public gateway commandagentsocks remote classifier commandagentsocks session message command

Technical profile

No independent profile published

This extension has no current independent technical profile. Catalog facts and any legacy launch remain separate and are not presented as profile evidence.

FAQ

Frequently asked questions

Evaluate

Evaluate this coverage

Read the exact source and stated limits first, then enable coverage through Guard’s controls. This page never runs a command or changes protection state.

0 Install guidance

Promote your extension hereLabeled sponsor spot. Scores never change with placement.From $200/mo

Evaluation evidence

Hidden compatible · Hidden incompatible · Hidden need help. Unavailable self-reported · Unavailable validated evidence.

Evaluation totals are unavailable because the source evidence is not connected for the fixed 30-day UTC window. Organization ownership is unknown.

Feedback here is non-sensitive and self-reported. Do not paste prompts, commands, file paths, credentials, or detection output.

Evaluation feedback opens once the publisher publishes a technical profile or launch for this version.

Contribution identity

Community contribution with recorded provenance and 1 recorded maintainer. A verified publisher profile attributes the contributor. It is not an upstream endorsement or a HOL safety certification.