Zedly Shield

Runtime governance, PII redaction, and audit logging for OpenClaw agents.

Shield intercepts every tool call and model response flowing through the OpenClaw Gateway, applying configurable security policies — blocking dangerous shell commands, redacting PII before it reaches model providers, and producing a tamper-evident event log for compliance.

Quick Start

1. Install the plugin

openclaw plugins install zedly-shield

2. Create a Shield instance

Sign in at zedly.ai/shield, click New Instance, and copy the generated API key.

3. Configure OpenClaw

Add the following to your ~/.openclaw/openclaw.json (merge into the existing plugins.entries block):

{
  "plugins": {
    "entries": {
      "zedly-shield": {
        "enabled": true,
        "config": {
          "apiUrl": "https://zedly.ai/api/shield",
          "apiKey": "sk_shield_YOUR_KEY_HERE"
        }
      }
    }
  }
}

4. Restart the Gateway

openclaw gateway

Shield is now active. Events appear in your Shield dashboard within seconds.

Configuration Reference

All config fields go inside plugins.entries.zedly-shield.config:

| Field | Type | Default | Description | |-------|------|---------|-------------| | enabled | boolean | true | Master on/off switch | | debug | boolean | false | Verbose logging (set SHIELD_DEBUG=1 env var as alternative) | | logDir | string | ~/.openclaw/zedly-shield | Local event log directory | | apiUrl | string | — | Zedly Shield API endpoint (e.g. https://zedly.ai/api/shield) | | apiKey | string | — | API key from your Shield dashboard | | blockDangerousShell | boolean | true | Block rm -rf /, chmod -R 777, curl | bash | | redactEmails | boolean | true | Replace email addresses with tokens in tool results | | redactSSN | boolean | true | Replace SSN patterns with tokens in tool results |

Policies configured on the dashboard are pulled automatically by the plugin.

Updating

openclaw plugins update zedly-shield

Or update all plugins at once:

openclaw plugins update --all

Troubleshooting

Plugin not loading

• Run openclaw plugins list and confirm zedly-shield appears and is enabled.
• Check for config validation errors: openclaw plugins doctor

No events on dashboard

• Verify apiUrl and apiKey are set in your config.
• Run with SHIELD_DEBUG=1 openclaw gateway and look for [shield:forward] log lines.

False policy blocks

• Adjust policies from the Shield dashboard (zedly.ai/shield → your instance → Policy tab).
• Changes take effect on the next plugin poll cycle (up to 5 minutes).

TypeScript / build errors on install

• You should never need to build from source. If you see build errors, you may have installed from a local directory instead of npm. Reinstall: openclaw plugins uninstall zedly-shield && openclaw plugins install zedly-shield

Requirements

• Node.js 20+
• OpenClaw 2026.3 or later

Links

• Dashboard: zedly.ai/shield
• Documentation: zedly.ai/docs/shield
• Issues: github.com/zedly-ai/zedly-shield/issues

License

Apache-2.0