GuardRail places deterministic security checks between an AI coding agent and your shell. With its tested Claude Code adapter, it blocks recognized patterns for destructive commands, secret exposure, unsafe database operations, and protected-branch pushes before execution.
$ npx guardrail-agent init
Compare plans
Native Claude Code integration today · Codex CLI and Gemini CLI adapters planned next · The guard engine does not depend on an LLM
AI coding agents are powerful because they can execute any command. That is also why they are dangerous. One wrong assumption, one hallucinated flag, one misunderstood instruction.
It connected to the production database instead of test. The table had 12,000 user profiles.
API keys, database passwords, SMTP credentials appeared in the conversation. The context window became a security incident.
It force-pushed to the production branch, overwriting three days of team commits.
GuardRail connects to an agent runtime through a small adapter and checks every command before it runs. The current installer configures Claude Code automatically. The guard engine itself is model-independent, so the same rules can protect additional runtimes as tested adapters become available.
One command adds GuardRail to your project. It configures the hooks directory and installs 10 core security guards.
$ npx guardrail-agent init
Your AI agent runs commands as usual. GuardRail checks each one against the guard chain. Safe commands pass through without delay.
When a command matches a known dangerous pattern, GuardRail blocks it before execution. The agent sees why it was blocked and adjusts.
Watch a real policy check block a high-risk command before execution, explain the decision, and leave the developer in control.
Ten readable MIT-licensed rules for common high-impact mistakes, backed by dispatcher, installer, regression, and adversarial tests.
Blocks direct push to main/master, force push, and git reset --hard.
Blocks env, printenv, /proc/environ, docker inspect without --format.
Blocks exfiltration to webhook.site, requestbin, pipedream, and similar services.
Blocks rm -rf on /etc, /usr, /var, /home, and other critical system paths.
Blocks iptables flush, ufw disable, nft flush ruleset.
Blocks stop/disable/kill on sshd, docker, postgres, nginx, and other critical services.
Blocks UPDATE/DELETE without WHERE clause on protected database tables.
Detects full environment dumps in command output and flags the exposure.
Detects prompt injection attempts in command output before they reach the agent.
Catches empty catch blocks in payment, webhook, and cron code during file edits.
GuardRail was not designed on a whiteboard. It was extracted from a production system that runs AI coding agents across multiple live applications. Every guard exists because something went wrong.
Each guard was written after a real event. Database wipe, secret leak, firewall disabled, production branch overwritten. The patterns come from what actually happens, not what might.
The underlying guard patterns run across a multi-app infrastructure. The public Core has a separate release suite, including real dispatcher payloads and safe-command controls.
The 10 core guards are MIT licensed and free. The Pro tier adds advanced guards derived from real production incidents. Both tiers run the same architecture.
Core guards catch the obvious threats. Pro guards catch the subtle ones: multi-step attacks that look harmless individually, agents disabling their own safeguards, PII leaking through unexpected vectors.
Scans agent outputs for personal data across 10 EU countries. Detects IBAN, tax IDs, names, addresses. 3-tier classification: DETECTED, REVIEW, CLEAR.
Structured JSONL logging of every agent action. Daily file rotation, configurable retention. The evidence layer for compliance reporting.
Maps technical controls to governance requirements, records limitations, and highlights gaps that still need organizational or legal assessment.
Tracks command sequences across a session. Detects coordinated reconnaissance patterns that single-command guards miss.
Detects when an AI agent attempts to modify, disable, or circumvent its own security guards. A real pattern we discovered in production.
50+ attack patterns to validate your guard chain. Profile escape testing. Bypass persistence checks. Generates a structured report.
Need a compliance package for your organization?
€4,900 one-time
Compliance Kit: Guard configuration for your stack, EU AI Act gap analysis, documentation templates, 2h setup call.
Request Compliance KitBuilt-in confirmations and sandboxes remain important. GuardRail adds repeatable, organization-specific checks for the exact operations that cause production incidents.
| Capability | Agent permissions | Sandbox | GuardRail |
|---|---|---|---|
| Ask before broad tool use | Yes | Varies | Yes, through the host agent |
| Recognize unsafe SQL without WHERE | Not consistently | No | Deterministic rule |
| Protect named branches, tables and services | Manual | Environment-level | Configurable policy |
| Detect multi-step reconnaissance | No | No | Pro |
| Produce a readable policy trail | Limited | Limited | Structured audit evidence |
A coding agent is not automatically a high-risk AI system under the EU AI Act. Classification depends on intended purpose and context. GuardRail contributes technical controls and evidence to a broader governance program; it is not legal advice and does not create compliance by itself.
Guard classification per risk level. PEN-test framework for validation. Risk-based guard activation per command profile.
PII gates help prevent secret exposure. Environment dump detection. Container inspection controls.
Timestamped audit log. Every blocked command recorded with guard name, reason, and session context.
Pre-execution gates block before damage occurs. Approval workflows for critical operations.
Injection defense. Regression test suite. Continuous validation of guard accuracy.
No. It is an additional enforcement layer for agent actions. Keep least-privilege access, backups, branch protection, database permissions, network controls, and human approval for critical operations.
Core ships with conservative defaults and safe-command controls. Protected branches, tables, paths, and custom guards can be adapted to your environment. Every blocked action includes a reason so the agent can choose a safer path.
Claude Code has a tested, zero-configuration integration today. The guards are model-independent, but each agent runtime needs a tested adapter for its event and decision format. Codex CLI and Gemini CLI are next; runtimes without a pre-execution interception point cannot provide the same blocking guarantee.
This applies when the Agent Safety Bundle connects GuardRail to the managed Shield API. GuardRail does not silently treat an unavailable or unknown API response as clear; it reports that the data check could not be verified so your workflow can apply the appropriate policy.
Yes. A process that can rewrite GuardRail itself or control the host is outside its containment boundary. Install the protection outside agent-writable workspaces and restrict host permissions.
Start with the free Core, upgrade for advanced protection, or combine action security with European personal-data detection.
$ npx guardrail-agent init
Choose a plan