---
title: Command generator
description: Build a non-interactive `defenseclaw setup guardrail` command for any connector. Pick mode, scanner backend, detection strategy, rule pack, HITL behaviour, and every advanced knob; copy the result straight into your terminal or CI pipeline.
keywords:
  - DefenseClaw command generator
  - defenseclaw setup guardrail non-interactive
  - DefenseClaw CI setup
  - DefenseClaw HITL command
  - DefenseClaw LLM judge command
  - DefenseClaw connector setup generator
---

`defenseclaw setup guardrail` is fully scriptable — every prompt in the interactive wizard has a flag, with [three documented exceptions](/docs/setup/guardrail#prompt--flag-mapping). The generator below lets you build the exact `--non-interactive` invocation for any connector without leaving the docs. Pick the knobs; the command rewrites itself live; the **Notes & validation** panel flags combinations that won't behave the way you expect (e.g. HITL in observe mode, remote scanner with no Cisco endpoint, connectors that can't fail closed).

<Callout>
Generated commands are display-only. Nothing on this page runs against your machine — copy the result and paste it into the terminal of whichever host you operate.
</Callout>

<CommandGenerator />

## What the generator covers

<Cards>
  <Card title="Connector picker" description="All nine first-class connectors — proxy (OpenClaw, ZeptoClaw) and hooks (Claude Code, Codex, Cursor, Windsurf, Gemini CLI, GitHub Copilot CLI, Hermes). Each card surfaces whether the connector supports native ask and fail-closed enforcement so HITL decisions are informed." />
  <Card title="Mode + scanner backend" description="--mode (observe / action) and --scanner-mode (local / remote / both). Picking remote or both surfaces the Cisco endpoint, API key env var, and timeout fields, and emits a placeholder export so you remember to set the key." />
  <Card title="Detection strategy + judge" description="--detection-strategy (regex_only / regex_judge / judge_first). Switching off regex_only opens the judge model, judge API base, and judge API key env var inputs and adds the matching export line to the generated script." />
  <Card title="Rule pack" description="--rule-pack (default / strict / permissive). Locked to action mode so the disabled state matches the CLI semantics." />
  <Card title="HITL" description="--human-approval + --hilt-min-severity (critical / high / medium / low). Disabled in observe mode. The connector card explains whether the prompt fires natively inside the agent UI or downgrades to a defenseclaw tui confirm." />
  <Card title="Advanced knobs" description="--port, --block-message, --disable-redaction, --restart / --no-restart, --verify / --no-verify. The disable-redaction toggle emits a prominent warning so you don't ship un-redacted prompts to external sinks by accident." />
</Cards>

## Conventions the generator follows

1. **`--non-interactive` is always emitted** — the whole point of this page is producing a flag-driven command. Drop the flag if you want the wizard to prompt for anything the generator left blank.
2. **`defenseclaw setup guardrail` is always the verb.** The hook-only aliases (`defenseclaw setup claude-code`, etc.) only configure observability and accept a much smaller flag surface; the guardrail verb works for all nine connectors and is the path documented for CI.
3. **Values containing whitespace or shell metacharacters are POSIX-quoted.** Single quotes wrap any token outside the safe alphanumeric + `_./:@-` allow-list, with the standard `'\''` escape for embedded apostrophes. Copy-paste into `bash`, `zsh`, `dash`, or `fish` (interactive mode) without surprises.
4. **Conflicting choices surface as warnings, not errors.** The generator never refuses to build a command — if you ask for `--human-approval` in observe mode, the flag is omitted (matching CLI behaviour) and a note explains why. Mistakes you should think about live in the **Notes & validation** panel.

## Related

<Cards>
  <Card title="defenseclaw setup guardrail" href="/docs/setup/guardrail" description="The narrative reference for every flag, including the three interactive-only prompts." />
  <Card title="HITL" href="/docs/hitl" description="Per-connector native-ask vs downgraded-confirm matrix and the decision flow." />
  <Card title="Capability matrix" href="/docs/capability-matrix" description="Connector × capability comparison the generator reads from at build time." />
  <Card title="CLI commands" href="/docs/reference/cli" description="Full CLI surface — first run, setup, audit, scanning, gateway control, status." />
</Cards>
