Install the OpenClaw Runtime Protection Plugin to connect your OpenClaw applications to Alibaba Cloud AI Guardrails for real-time security monitoring.
Product overview
The OpenClaw Runtime Protection Plugin connects your OpenClaw applications to Alibaba Cloud AI Guardrails, enabling real-time security monitoring across four protection dimensions: content compliance, prompt injection attacks, sensitive information leakage, and malicious file detection.
Before installing the plugin, review the Data collection checklist section to understand what data the plugin collects.
Data collection checklist
The plugin collects device and environment information, OpenClaw configuration, large language model (LLM) request and response content, and Tool Call information to implement runtime protection.
The plugin does not collect the following sensitive information from standard HTTP request headers: Authorization, X-API-Key, API-Key, apikey, X-Auth-Token, auth-token, Cookie, Set-Cookie.
|
Category |
Description |
Examples/Details |
|
Device context |
Information about the device and runtime environment where OpenClaw is running |
machine_id, platform (OS), architecture (x64, arm64), Node.js version, region |
|
OpenClaw config |
Configuration details of the OpenClaw instance |
OpenClaw version, Gateway configuration, Providers, Agents, Skills, Tools list |
|
LLM content |
Request prompts and model responses for security auditing |
User input, model output, token count, model name, conversation history |
|
Tool Call info |
Information about function calls and external tool invocations |
Tool name, parameters, execution results, timestamps |
Data transmission: All collected data is transmitted over HTTPS to two Alibaba Cloud services — Management Server (for configuration and policy retrieval) and Protection Server (for real-time threat detection).
Prerequisites
Required
Before you begin, make sure you have:
|
Requirement |
Verification command |
Expected output |
|
Node.js 22 or later |
|
v22.0.0 or higher |
|
OpenClaw installed |
|
OpenClaw command help output |
|
AI Guardrails console access |
Log in to the Alibaba Cloud console |
Access to AI Guardrails Runtime Protection page |
Recommended
Review the default security policies and adjust protection dimensions based on your business needs before installing.
Prepare test requests containing simulated risks to verify plugin functionality after installation.
Installation overview
Installing the plugin involves five steps:
Log in to the AI Guardrails console.
Authorize the security plugin to invoke AI Guardrails service.
Review the default security policy and adjust label configurations for your business requirements. The plugin uses the dedicated service
agent_runtime_guardto provide protection capabilities. We recommend enabling the following protection dimensions: content compliance violations, prompt injection attacks, sensitive information leakage, and malicious file detection.Get the installation command from the AI Guardrails console guidance page. This command has a limited validity period and expires after that time. If the command expires, regenerate it from the console. To prevent accidental exposure, use the console refresh button to update the command.
Complete installation using the auto-install or manual install option.
Choose an installation option
|
Feature |
Auto-install (Option 1) |
Manual install (Option 2) |
|
Ease of use |
One-click setup, fully automated |
Requires manual execution |
|
Control level |
Standard configuration |
Full customization available |
|
Gateway restart |
Handled automatically |
Required manually |
|
Best for |
Most users |
Advanced scenarios |
Install the plugin automatically
The auto-install option lets OpenClaw handle plugin installation and configuration in a single command.
Procedure
-
Get the installation command from the AI Guardrails console:
Get the installation command from the AI Guardrails console:
Log in to the AI Guardrails console.
Navigate to Runtime Protection > Plugin Management.
Click Obtain Installation Command and copy the complete command.
The command follows this format:
openclaw install aliyun://security-assistant?token=<your-token>ImportantThe actual command must be dynamically generated from the console, containing authorization information and policy configuration, with a validity period of 24 hours.
Pass the copied command directly to OpenClaw. OpenClaw installs the plugin and immediately enables security protection for your agent.
-
Verify the installation:
-
Check that the plugin appears in the output of:
openclaw plugins info @alicloud/openclaw-security-assistant Send a test request containing a simulated risk or tool invocation.
In the AI Guardrails console, navigate to Runtime Protection > Blocking Logs. A blocking event entry confirms the plugin is active and detecting threats.
-
Install the plugin manually
Use the manual install option when you need full control over the installation process or want to customize it.
Procedure
-
Run the installation command from the AI Guardrails console:
openclaw plugins install @alicloud/openclaw-security-assistant --saveImportantYou must restart the OpenClaw Gateway during installation to activate the plugin.
-
Confirm the installation status:
openclaw plugins info @alicloud/openclaw-security-assistantTo see all installed plugins:
openclaw plugins list -
Verify the installation:
Send a test request containing a simulated risk or tool invocation.
In the AI Guardrails console, navigate to Runtime Protection > Blocking Logs. A blocking event entry confirms the plugin is active and detecting threats.
Troubleshooting
If blocking logs don't appear in the console or the plugin appears non-functional, check the following:
Verify the plugin is installed: run
openclaw plugins listand confirm@alicloud/openclaw-security-assistantappears in the output.For manual installation: confirm the OpenClaw Gateway has been restarted.
Verify that console authorization and policy configurations are correct.
Check network connectivity to confirm the plugin can reach the AI Guardrails Management Server and Protection Server.
Uninstall the plugin
Uninstall the plugin if:
Runtime protection is no longer needed for your OpenClaw instance.
You are troubleshooting plugin-related issues.
You are migrating to an alternative security solution.
Uninstalling the plugin removes all protection. Traffic currently protected by the plugin will no longer be secured, and security policies configured in the AI Guardrails console will no longer be enforced.
Run the following command to uninstall:
wget -q "https://update.aegis.aliyun.com/download/openclaw-security-assistant/1.0.0/linux/openclaw-security-assistant-install.sh" && chmod +x openclaw-security-assistant-install.sh && ./openclaw-security-assistant-install.sh uninstallVerify the plugin has been removed:
openclaw plugins list