Agent Guardrails
Drop-in · Zero dependencies · MIT

Stop your AI coding agent
from nuking your repo.

Two hooks that block destructive shell commands before they run — and keep a tamper-evident audit log of every tool call your agent makes.

Get it — $12 Try the free checker 
$ agent: rm -rf ./build /
⛔ Blocked by agent-guardrails: recursive/forced file removal (rm -rf)
$ agent: git push origin main --force
⛔ Blocked by agent-guardrails: git push --force
$ agent: rm notes.txt
✓ allowed  (~2 ms, no daemon, no network)

One bad command is all it takes

Agents run real commands on real machines. These guards sit between the model and your shell.

Recursive deletes

rm -rf /, rm -fr build, sudo rm -rf --no-preserve-root — caught, including the tricky flag orders.

Destructive SQL

DROP TABLE, TRUNCATE TABLE, and DELETE FROM with no WHERE clause.

History rewrite

git push --force, git reset --hard, git clean -f.

Disk-level damage

mkfs, dd of=/dev/…, fork bombs, world-writable recursive chmod.

Full audit trail

Every tool call appended to a JSONL log — timestamp, tool, input, cwd. Great for review and compliance.

Passes the safe stuff

rm notes.txt, DELETE FROM t WHERE id=1, git push origin main run untouched.

BlockedAllowed
rm -rf /rm notes.txt
git push --forcegit push origin main
DELETE FROM usersDELETE FROM users WHERE id=1
mkfs.ext4 /dev/sda1docker compose up -d

Install in two commands

mkdir -p ~/.claude/hooks && cp hooks/*.py ~/.claude/hooks/

Then merge settings.example.json into ~/.claude/settings.json. Works with Claude Code hooks, and any agent that pipes tool-call JSON to a subprocess (OpenClaw, Codex-style shells).

Why it's not just five lines of bash

The regex set avoids the classic false-negatives (-fr, --recursive, sudo rm -rf), it returns the correct exit-code semantics so the agent actually stops, it writes structured JSONL logs, and it ships with a passing test suite (17 assertions).

Pricing

$12 one-time

Instant download. No account required.

  • Destructive-command guard (PreToolUse)
  • Tool-call audit logger (PostToolUse)
  • Paste-in settings.json config
  • Test suite incl. 17 assertions
  • macOS / Linux + Windows install docs
Buy now
Free source

MIT-licensed. Read every line before you trust it.

  • No telemetry
  • No network calls
  • No daemon, no dependencies
  • ~2 ms per tool call

FAQ

Which agents does it work with?

Any agent that runs shell commands through a hook or subprocess interface: Claude Code (native hooks), plus OpenClaw, Codex-style shells, and custom runners that pipe tool-call JSON to a command.

What language is it written in?

Python 3.8+. No third-party packages. One file per hook.

Can I add my own rules?

Yes — add or remove regexes in the _RULES list, and point logs elsewhere with the GUARDRAIL_LOG env var.

Does it slow the agent down?

Roughly 2 ms per tool call, with no daemon and no network access.