back
loading skill details...
Real-time security monitoring and circuit breaker controls for Sardis agent wallets
---
name: sardis-guardrails
description: Real-time security monitoring and circuit breaker controls for Sardis agent wallets
version: 1.0.0
metadata:
openclaw:
requires:
env:
- SARDIS_API_KEY
bins:
- curl
- jq
primaryEnv: SARDIS_API_KEY
emoji: "🛡️"
homepage: https://sardis.sh
install:
npm:
- "@sardis/sdk"
user-invocable: true
disable-model-invocation: false
---
# Sardis Guardrails - Real-Time Security Controls
Comprehensive security monitoring and emergency controls for agent wallets. Protect against runaway spending, anomalous behavior, and security threats with circuit breakers and kill switches.
## Capabilities
- **Circuit Breaker Status**: Check if automatic spending halts are active
- **Kill Switch Control**: Emergency stop all transactions wallet-wide
- **Rate Limit Monitoring**: Track transaction velocity and spending patterns
- **Behavioral Alerts**: Get warnings for anomalous agent behavior
- **Emergency Controls**: Immediate response to security threats
## Security Model
**CRITICAL CONTROLS**: This skill can activate emergency stops that halt all wallet transactions. Use with caution.
## Quick Setup
```bash
export SARDIS_API_KEY=sk_your_key_here
```
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Check Circuit Breaker Status
```bash
# Get current circuit breaker and kill switch status
curl -X GET https://api.sardis.sh/v2/guardrails/status \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: wallet_abc123"
# Example response:
# {
# "wallet_id": "wallet_abc123",
# "circuit_breaker": {
# "active": false,
# "reason": null,
# "triggered_at": null
# },
# "kill_switch": {
# "active": false,
# "activated_by": null,
# "activated_at": null
# },
# "rate_limits": {
# "tx_per_minute": 5,
# "current_rate": 2.3,
# "threshold_breached": false
# },
# "status": "operational"
# }
```
### Activate Kill Switch
```bash
# Emergency stop all transactions for a wallet
curl -X POST https://api.sardis.sh/v2/guardrails/kill-switch/activate \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"wallet_id": "wallet_abc123",
"reason": "Suspected unauthorized activity detected"
}'
# Response:
# {
# "wallet_id": "wallet_abc123",
# "kill_switch_active": true,
# "activated_at": "2026-02-21T10:30:00Z",
# "reason": "Suspected unauthorized activity detected",
# "message": "All transactions halted. Contact support to reactivate."
# }
```
### Deactivate Kill Switch
```bash
# Resume normal operations after investigation
curl -X POST https://api.sardis.sh/v2/guardrails/kill-switch/deactivate \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"wallet_id": "wallet_abc123"
}'
# Response:
# {
# "wallet_id": "wallet_abc123",
# "kill_switch_active": false,
# "deactivated_at": "2026-02-21T11:00:00Z",
# "message": "Wallet operational. Transactions resumed."
# }
```
### Check Rate Limits
```bash
# Monitor transaction velocity and spending rate
curl -X GET https://api.sardis.sh/v2/guardrails/rate-limits \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: wallet_abc123"
# Example response:
# {
# "wallet_id": "wallet_abc123",
# "limits": {
# "tx_per_minute": {
# "limit": 5,
# "current": 2.3,
# "percentage_used": 46.0,
# "breached": false
# },
# "tx_per_hour": {
# "limit": 100,
# "current": 45,
# "percentage_used": 45.0,
# "breached": false
# },
# "spend_per_hour_usd": {
# "limit": "1000.00",
# "current": "325.50",
# "percentage_used": 32.55,
# "breached": false
# }
# },
# "status": "healthy"
# }
```
### Get Behavioral Alerts
```bash
# Retrieve anomaly detection alerts
curl -X GET https://api.sardis.sh/v2/guardrails/alerts \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: wallet_abc123"
# Filters:
# - severity: low, medium, high, critical
# - limit: Number of alerts (default 20, max 100)
# - since: ISO 8601 timestamp for alerts after this time
# Example with filters:
curl -X GET "https://api.sardis.sh/v2/guardrails/alerts?severity=high&limit=10" \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: wallet_abc123"
```
## Example Commands
### Emergency Stop Workflow
```bash
# 1. Check current status
WALLET_ID=wallet_abc123
STATUS=$(curl -s -X GET https://api.sardis.sh/v2/guardrails/status \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: $WALLET_ID")
echo "Current Status:"
echo "$STATUS" | jq '.'
# 2. Activate kill switch if needed
if [[ $(echo "$STATUS" | jq -r '.circuit_breaker.active') == "true" ]]; then
echo "Circuit breaker already active!"
curl -X POST https://api.sardis.sh/v2/guardrails/kill-switch/activate \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"wallet_id\": \"$WALLET_ID\", \"reason\": \"Manual emergency stop\"}"
fi
```
### Rate Limit Monitor
```bash
# Monitor and alert on high transaction rates
WALLET_ID=wallet_abc123
while true; do
LIMITS=$(curl -s -X GET https://api.sardis.sh/v2/guardrails/rate-limits \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: $WALLET_ID")
TX_RATE=$(echo "$LIMITS" | jq -r '.limits.tx_per_minute.current')
THRESHOLD=80
USAGE=$(echo "$LIMITS" | jq -r '.limits.tx_per_minute.percentage_used')
if (( $(echo "$USAGE > $THRESHOLD" | bc -l) )); then
echo "WARNING: Transaction rate at ${USAGE}% of limit"
echo "Current: $TX_RATE tx/min"
fi
sleep 30
done
```
### Behavioral Alert Dashboard
```bash
# Get critical alerts and display summary
WALLET_ID=wallet_abc123
echo "=== Critical Security Alerts ==="
curl -s -X GET "https://api.sardis.sh/v2/guardrails/alerts?severity=critical&limit=5" \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: $WALLET_ID" | jq '.alerts[] | "\(.timestamp) - \(.type): \(.message)"'
echo -e "\n=== High Priority Alerts ==="
curl -s -X GET "https://api.sardis.sh/v2/guardrails/alerts?severity=high&limit=5" \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: $WALLET_ID" | jq '.alerts[] | "\(.timestamp) - \(.type): \(.message)"'
```
### Automated Circuit Breaker Response
```bash
# Check for circuit breaker activation and notify
WALLET_ID=wallet_abc123
STATUS=$(curl -s -X GET https://api.sardis.sh/v2/guardrails/status \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "X-Wallet-ID: $WALLET_ID")
if [[ $(echo "$STATUS" | jq -r '.circuit_breaker.active') == "true" ]]; then
REASON=$(echo "$STATUS" | jq -r '.circuit_breaker.reason')
echo "ALERT: Circuit breaker triggered!"
echo "Reason: $REASON"
# Send notification (integrate with your alerting system)
# curl -X POST https://your-webhook.com/alert -d "Circuit breaker active: $REASON"
fi
```
## Response Examples
### Guardrails Status Response
```json
{
"wallet_id": "wallet_abc123",
"circuit_breaker": {
"active": false,
"reason": null,
"triggered_at": null,
"auto_recovery": true,
"recovery_threshold": "10 minutes below threshold"
},
"kill_switch": {
"active": false,
"activated_by": null,
"activated_at": null,
"requires_manual_reset": true
},
"rate_limits": {
"tx_per_minute": {
"limit": 5,
"current": 2.3,
"breached": false
},
"tx_per_hour": {
"limit": 100,
"current": 45,
"breached": false
},
"spend_per_hour_usd": {
"limit": "1000.00",
"current": "325.50",
"breached": false
}
},
"status": "operational",
"last_checked": "2026-02-21T10:30:00Z"
}
```
### Behavioral Alerts Response
```json
{
"wallet_id": "wallet_abc123",
"alerts": [
{
"alert_id": "alert_xyz789",
"severity": "high",
"type": "unusual_recipient",
"message": "Transaction to new recipient with no prior history",
"details": {
"recipient": "0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb",
"amount": "500.00",
"token": "USDC",
"deviation": "high"
},
"timestamp": "2026-02-21T09:45:00Z",
"auto_blocked": false,
"requires_review": true
},
{
"alert_id": "alert_abc456",
"severity": "medium",
"type": "velocity_spike",
"message": "Transaction rate 3x higher than normal baseline",
"details": {
"normal_rate": "2.5 tx/min",
"current_rate": "7.8 tx/min",
"duration": "5 minutes"
},
"timestamp": "2026-02-21T09:30:00Z",
"auto_blocked": false,
"requires_review": false
}
],
"total": 2,
"has_critical": false
}
```
### Kill Switch Activation Response
```json
{
"wallet_id": "wallet_abc123",
"kill_switch_active": true,
"activated_by": "api_key_sk_xyz",
"activated_at": "2026-02-21T10:30:00Z",
"reason": "Suspected unauthorized activity detected",
"affected_transactions": {
"pending_count": 3,
"pending_total_usd": "125.50",
"all_blocked": true
},
"message": "All transactions halted. Contact support@sardis.sh to reactivate.",
"reactivation_requires": ["manual_approval", "security_review"]
}
```
## Error Handling
- `401 Unauthorized` - Invalid or missing API key
- `403 Forbidden` - No access to this wallet or insufficient permissions
- `404 Not Found` - Wallet does not exist
- `409 Conflict` - Kill switch already in requested state
- `429 Too Many Requests` - Rate limit exceeded
## Use Cases
- **Security Incident Response**: Emergency stop during security threats
- **Anomaly Detection**: Catch unusual spending patterns early
- **Compliance Monitoring**: Track transaction velocity for regulatory compliance
- **Automated Safety**: Circuit breakers prevent runaway spending
- **Alert Automation**: Integrate with monitoring systems for real-time alerts
## Related Skills
- `sardis-balance` - Monitor wallet balances and spending
- `sardis-policy` - Define spending rules and limits
- `sardis-payment` - Execute controlled payments
## Links
- Website: https://sardis.sh
- Documentation: https://sardis.sh/docs/guardrails
- API Reference: https://api.sardis.sh/v2/docs
- Security: https://sardis.sh/security
- Support: support@sardis.sh
don't have the plugin yet? install it then click "run inline in claude" again.