Guardrails and an audit trail for teams adopting coding agents

The problem

Coding agents are fast. They also run real commands in real repos. These are hypothetical examples, not customer stories.

Each of these is cheap to prevent. Few teams have the rules written down in a form the agent cannot skip.

How it works

1. Install. Add the plugin to Claude Code. Pick a starter policy: strict-fintech, oss-maintainer or agency-client-work.
2. Run as normal. Hooks check each shell command and file edit before it runs. Risky ones are blocked, with the reason shown to the agent.
3. Review. Every decision goes into an audit log. Run the report command to see what was blocked, what was allowed and why.

Install

Local, from a clone:

claude --plugin-dir ./agent-guardrails

From a marketplace, once published:

/plugin marketplace add RichFloForge/agent-guardrails
/plugin install agent-guardrails@agent-guardrails-marketplace

Then, in your project, optionally create a config. Defaults work with no config. Requires python3 on the PATH.

/agent-guardrails:init --policy strict-fintech

Config lives in .claude/guardrails.json and is merged over the defaults, so you only write what you change:

{
  "fail_closed": false,
  "protected_branches": ["main", "master", "production"],
  "rules": {
    "destructive_shell": { "mode": "block" },
    "scope_shell": {
      "enabled": true,
      "mode": "warn",
      "blocked_commands": ["npm publish", "terraform apply"]
    }
  }
}

What it blocks

• Destructive shell commands: rm -rf of /, ~, . or *; force-push or deletion of protected branches; git reset --hard; git clean -fd; DROP TABLE/DATABASE; truncate; mkfs; dd if=; chmod -R 777; curl | sh; fork bombs.
• Secrets written into files: AWS keys, private key headers, GitHub tokens, Slack tokens, Stripe live keys and api_key/secret/password/token assignments. Values are never printed or logged.
• Edits to protected paths: .env, .env.*, *.pem, *.key, id_rsa*, .git/**, secrets/ and any paths you add.
• Commands your team has banned: optional, off by default. For example npm publish or terraform apply.
• Audit log: every tool call goes to a local JSONL file, with a report command.

Limits: hooks only see tool calls Claude Code makes. This is not a sandbox, and pattern matching can be bypassed by obfuscation. It is one layer, not a full security boundary. You still need review and backups.

Services

Fixed scope. Written quote. 50% deposit, remainder on delivery. UK clients to start. Prices are totals; VAT not charged (not VAT registered). Work is done by the operator with AI agents and reviewed by a human before delivery.

See scope and request a quote

FAQ