Qoder runtime AI security protection-AI Guardrails(AI Guardrails)-阿里云帮助中心

Qoder, QoderCLI, and QoderWork are enterprise coding Agents that face runtime risks such as prompt injection, sensitive data leakage, and malicious command execution. Relying solely on the model's own capabilities is not enough to effectively defend against these threats. This topic describes how to use AI Guardrails to build runtime security protection for Qoder series Agents through a native Qoder plugin. The plugin detects and blocks potential threats in real time at both user input and model output stages, ensuring that Agents run safely and controllably.

Solution overview

The Qoder series is an enterprise coding Agent product family that includes Qoder (IDE plugin), QoderCLI (command-line tool), and QoderWork (desktop workbench). These platforms use natural language instructions to call large language models (LLMs) and complete coding tasks. However, at runtime, coding Agents face the following security risks:

Prompt injection: Attackers manipulate the model into outputting malicious code or performing unauthorized operations through carefully crafted inputs.
Sensitive data leakage: The model may accidentally expose sensitive content such as enterprise source code, API keys, or internal API addresses when generating code.
Malicious command execution: Attackers induce the model to access phishing links or download trojan files, threatening the security of the development environment.

Alibaba Cloud AI Guardrails provides protection for Agent input and output. Through the native Qoder plugin, risks are detected in real time at both the user input (Prompt) and model output (Response) stages to intercept threat requests. The protection mechanisms include:

Prompt injection detection: Input detection is performed before requests are sent to the LLM to identify prompt injection and jailbreak attacks, intercept maliciously constructed instructions, and prevent the model from being manipulated into outputting malicious code or performing unauthorized operations.
Sensitive data leakage detection: During input, sensitive information such as enterprise source code, API keys, and internal API addresses is desensitized so that real sensitive data does not enter the model side. During output, sensitive information leakage in responses is detected and intercepted. At the same time, desensitized content can be restored to avoid exposing sensitive data during transmission and on the model side without affecting the normal coding experience.
Malicious command execution detection: Output detection is performed before model responses are returned to users to identify phishing links, trojan file downloads, and other malicious links and dangerous content, and filter them out to prevent coding Agents from being induced to perform operations that threaten the development environment.

Prerequisites

Before you install the plugin, make sure that the environment meets the following requirements.

Environment dependencies

Based on the coding Agent type you use, confirm that the corresponding installation is complete:

Agent type	Installation requirement
Qoder	Qoder IDE plugin (Enterprise Edition) is installed
QoderCLI	QoderCLI command-line tool is installed
QoderWork	QoderWork desktop workbench is installed

Permission requirements

You must have an Alibaba Cloud account and access permissions for the AI Guardrails console.
Enterprise admin permissions are required to pack and distribute the plugin.

Install the plugin

The plugin format is the same for Qoder, QoderCLI, and QoderWork. Use the pack command of the installer script to pack the plugin into a native Qoder plugin package, and then perform the following steps.

This procedure involves two types of roles with different installation methods. If you are an enterprise administrator, we recommend that you use unified distribution to deploy the plugin directly to target users in your enterprise. If you are an individual developer, you can install the plugin on your own:

Enterprise administrator: Perform Step 1 through Step 7. For Step 5, use Method 1 (admin unified distribution).
Individual developer: Perform Step 1 through Step 7. For Step 5, use Method 2 (personal installation).

The overall procedure is as follows:

Authorize the security plugin to call AI Guardrails
Confirm and configure detection policies
Obtain installation credentials
Pack the plugin package
Install the plugin
Verify the installation result
Test the protection effect

Step 1: Authorize the security plugin to call AI Guardrails

Log on to the AI Guardrails console. In the left-side navigation pane, click Overview. In the Access Products section, find Qoder and open the Qoder plugin panel.
Next to Service-linked Role Authorization, click Authorize and complete the authorization as prompted.

Step 2: Confirm and configure detection policies

In the Confirm Detection Policy section of the Qoder plugin panel, click Go to Maintain.
On the agent_runtime_guard - Configuration page, adjust the protection dimensions based on your requirements. We recommend that you enable the following protection dimensions:
- Sensitive information detection: Detects personal or enterprise sensitive information that may appear during LLM usage to prevent data leakage.
- Prompt attack detection: Detects prompt manipulation targeting LLMs to prevent models from outputting malicious content or threatening system security.
- Malicious URL detection: Detects phishing links, trojan websites, and other risks in LLM-generated or parsed content to prevent data leakage and security intrusions.

Step 3: Obtain installation credentials

In the Obtain Installation Command section of the Qoder plugin panel, copy the installation credentials (the value of the --key parameter).

The installation credentials are valid for 24 hours. After they expire, you must obtain new credentials from the console. To prevent credential leakage, you can click the refresh button to regenerate them.

Step 4: Pack the plugin package

Use the pack command of the installer script to pack the native Qoder plugin package. Select the command based on your operating system.

macOS/Linux

wget -q "https://update.aegis.aliyun.com/download/agent-security-installer/1.0.1/installer.sh" && chmod +x installer.sh && sudo ./installer.sh pack --key "<installation_credentials>" --region "cn" --agent qoder --output ./coding-agent-security.zip

Windows

Invoke-WebRequest -UseBasicParsing -Uri
  "https://update.aegis.aliyun.com/download/agent-security-installer/1.0.1/installer.ps1"
  -OutFile ".\installer.ps1" -ErrorAction Stop; powershell.exe
  -NoProfile -ExecutionPolicy Bypass -File ".\installer.ps1" pack
  --key "<installation_credentials>" --region "cn" --agent qoder --output
  ".\coding-agent-security.zip"

Parameter description:

Parameter	Required	Description
`--agent`	Yes	Target Agent type. The current value is `qoder`.
`--key`	Yes	Installation credentials obtained in Step 3.
`--output`	No	Output path of the plugin package. By default, a ZIP file is generated in the current execution directory.

The plugin package format is the same for Qoder, QoderCLI, and QoderWork.

Step 5: Install the plugin

After completing Step 4, select the installation method based on the deployment scenario and user role.

Method 1: Admin unified distribution

The enterprise administrator distributes the plugin to members in the organization through the management backend. Members do not need to manually perform operations.

Use an administrator account to log on to the Qoder Enterprise Edition console (regular members do not have this permission).
Go to Extensions & Marketplace > Enterprise Marketplace.
Upload the coding-agent-security.zip package generated in Step 4. The backend automatically parses the plugin name and version information. After confirming that the information is correct, proceed.
Set the distribution scope (such as all users or group-based distribution) and client policy (configurable by client, mandatory, or silent enabled).
Click Save Policy. After the distribution is successful, members in the organization can see and use the plugin in the Plugin Marketplace of their clients.

Method 2: Personal installation

QoderCLI and QoderWork users can install the plugin on their own after obtaining the packed plugin package. First, decompress the plugin package to obtain the plugin directory (the directory contains files such as .qoder-plugin/plugin.json).

QoderCLI

Install the decompressed plugin directory through the command line (make sure to use the decompressed plugin path instead of the ZIP file path):

unzip coding-agent-security.zip
qodercli plugins install ./coding-agent-security
qodercli plugins list

QoderWork

Import the local plugin in the Expert Suite of the client:

Open the Expert Suite (entry at the top of the left-side navigation pane) and click Install Suite in the upper-right corner.
Click Upload from Local and specify the path of the downloaded ZIP file.
Click Confirm to complete the installation.

Step 6: Verify the installation result

For QoderCLI users, run the following command to view the list of installed plugins. If the output includes the coding-agent-security plugin, the installation is successful.

qodercli plugins list

For Qoder and QoderWork users, open the plugin management interface of the client and confirm that the plugin is installed and enabled.

Step 7: Test the protection effect

Send test requests.

Send test requests that contain risk content such as sensitive words or abnormal instructions through Qoder, QoderCLI, or QoderWork.
View interception logs in the console.
- Log on to the AI Guardrails console. In the left-side navigation pane, click Detection Results > Result Query.
- On the Real-time Protection tab, filter by Service agent_runtime_guard and relevant time conditions to view interception logs.

Step 8: View Agent protection status

View the Agent protection status in the console.
- Log on to the AI Guardrails console. In the left-side navigation pane, click Agent Risk Observation > Agent Overview. In the Agent List section on the left, switch to Real-time Protection to view the offline and online status of all Agents that have the protection plugin installed.

Uninstall the plugin

If you no longer need to use AI Guardrails to protect Qoder series coding Agents, you can uninstall the plugin. Uninstallation removes the plugin and its configuration, and protection immediately becomes invalid.

Before you uninstall:

Confirm in the console that no active protection policies exist.
Confirm that service traffic has been switched to another protection solution.

Admin operations

On the Enterprise Marketplace page of the Qoder Enterprise Edition console, remove the distributed security protection plugin. After removal, the plugin is automatically uninstalled from the clients of target users.

Personal operations

For QoderWork: Find the security protection plugin in the Expert Suite of the client and select Uninstall or Remove.

For QoderCLI: Run the following command to uninstall the plugin.

macOS/Linux

./install.sh uninstall --agent qodercli

Windows

.\install.ps1 uninstall --agent qodercli

Troubleshooting

If you encounter issues during installation or verification, refer to the following troubleshooting table.

Issue	Possible cause	Troubleshooting steps
Pack command fails	Installer script is missing or lacks execution permission	Confirm that the `install.sh`/`install.ps1` file exists. On macOS/Linux, run `chmod +x install.sh` to grant execution permission.
	Installation credentials are invalid or expired	Obtain new installation credentials from the console and use them within the validity period.
	Network connection fails	Check the network connection and make sure that Alibaba Cloud APIs are accessible.
QoderCLI installation fails	Compressed package path is used instead of directory path	First decompress the `.zip` file into a directory, and then use the decompressed directory path to run the installation command.
QoderCLI installation fails	QoderCLI version is incompatible	Upgrade QoderCLI to the latest version.
Plugin is installed but not active	Plugin is not properly loaded	Restart Qoder, QoderCLI, or QoderWork and then check the plugin status again.
Plugin is installed but not active	Plugin configuration file is corrupted	Re-run the pack and installation procedure.
Interception does not take effect	Console authorization configuration is not complete	Log on to the console to check the authorization status and re-perform the authorization configuration in Step 1.
	Console policy configuration is not enabled	Go to the policy configuration page and confirm that the protection dimensions are enabled.
	Test request does not trigger detection rules	Enhance the risk characteristics of the test request (for example, add more obvious sensitive words).
No detection results in the console	Plugin is not properly connected to Protection Server	Check the network connection and confirm that the plugin can access Protection Server.
No detection results in the console	Detection result reporting delay	Wait 1 to 2 minutes and then refresh the console page.

Data collection list

The plugin collects the following data for runtime protection. The data collection scope is the same as that in OpenClaw Runtime AI Security Protection.

The plugin does not collect the following sensitive information in HTTP standard request headers: Authorization, X-API-Key, API-Key, apikey, X-Auth-Token, auth-token, Cookie, Set-Cookie

Device and environment information

Data item	Description	Purpose
machine_id	Device unique identifier	Identify device identity for security auditing
platform	Operating system platform (such as macOS and Windows)	Identify runtime environment type
arch	CPU architecture (such as x64 and arm64)	Adapt platform features
agent_type	Coding Agent type (qoder, qodercli, or qoderwork)	Identify Agent source
agent_version	Coding Agent version number	Adapt version features

LLM request/response content (security audit)

Data item	Description	Purpose
user_prompt	User-input prompt	Detect prompt attacks and sensitive content
system_prompt	System prompt	Detect configuration risks
llm_response	LLM-generated response content	Detect content compliance and sensitive information leakage
model_name	Model name invoked	Analyze model behavior characteristics

Tool call information (security audit)

Data item	Description	Purpose
tool_name	Tool name invoked	Detect malicious tool invocations
tool_input	Tool invocation input parameters	Detect injection attacks and sensitive information
tool_output	Tool execution return result	Detect information leakage
error_message	Tool execution error message (if any)	Detect abnormal behavior

Data transmission details

Service endpoint	Data type transmitted	Transmission frequency	Encryption method
Management Server	Device information, Agent configuration	Once at plugin startup, real-time on configuration changes	HTTPS + TLS 1.2+
Protection Server	LLM requests/responses, tool call information	Real-time per request	HTTPS + TLS 1.2+