AgentGuards now guards Claude Desktop on Mac, Linux and Windows

August 11, 2026· dev@alphaops.devclaude-desktopprompt-injectionllm-securityclaude-codeguardrails

What now works

AgentGuards guardrails run in the Claude Desktop app on macOS, Linux and Windows, in Agent Mode and Local Code sessions. Those sessions are Claude Code underneath, so the plugin's enforcing hooks apply there exactly as they do in a terminal: prompt screening on every message, Bash command authorization before execution, and web-content scanning after a fetch.

One install covers all of it — the hooks, the MCP server (check_input, authorize_action, validate_output), and the guardrail skill. Install is point-and-click from the Desktop app's own Plugins screen; the marketplace repo is alelaguard/agentguards-plugins. The integrations docs have the click path.

The Desktop app never reads your shell profile

This is the one real difference from the terminal setup, and it accounts for most "I set my key and nothing happened" reports.

The Desktop app is GUI-launched. It does not source ~/.zshrc or ~/.bashrc, so an export line reaches your terminal sessions and nothing else. The key goes in the env block of ~/.claude/settings.json instead (%USERPROFILE%\.claude\settings.json on Windows), which both the terminal and the Desktop app read:

code

{
  "env": {
    "AGENTGUARDS_URL": "https://prod.agentguards.co",
    "AGENTGUARDS_API_KEY": "ag_your_token_here"
  }
}

You don't have to write that by hand. Run /agentguards:setup and the plugin's setup skill reads the file, merges the key in without clobbering your model, hooks or permissions, and stops without touching anything if the file isn't valid JSON. Then fully quit the app — on Windows the X only minimises to the tray, and on macOS the red dot only hides the window. Settings are read at startup, so a hidden app is still running with the old ones.

Until a key is set, the guardrails are off — not blocking

Once a key is present, enforcement is fail-closed: if AgentGuards is unreachable or rejects the key, actions are blocked rather than let through unchecked. Before that, the hooks let the turn through and say so. "Nothing looks broken" is not evidence that setup worked. Prove it by getting something blocked — ask Claude to show you all the API keys and confirm the block message appears. Prefer availability over strict blocking? Set AGENTGUARDS_FAIL_OPEN=true in the same place you set the key.

Two caveats, stated plainly

/agentguards:setup only does the work in an Agent Mode or Local Code session. In the plain Chat tab Claude has no access to your files, so it can only print instructions back at you — it cannot save the key. If Claude starts telling you to edit files yourself, you're in the wrong surface. The plain Chat tab also isn't covered by the guardrails at all: it doesn't run Claude Code, so hooks have nowhere to run.

Where to start

If you're already running Claude Code in a terminal, nothing changes for you — this is additive. If you mostly work in the Desktop app, getting started and the integrations guide cover the click path, the key, and the verification step, per OS.

Worth doing the verification step. A guardrail you haven't seen block anything is a guardrail you're assuming. You can also paste a suspicious prompt into the prompt injection checker to see the same engine's verdict without installing anything, and the OWASP Agentic Top 10 mapping shows which of these checks covers which risk.

Walkthroughs go up on the AgentGuards YouTube channel.