GuardRail

Why it's ranked here

The core mechanism is honest engineering: it fails closed, so a missing rule file, a crashed rule or a malformed request blocks the command instead of waving it through. The installer proves the hook works before trusting it, firing a push to the main branch and expecting a refusal. An adversarial suite of roughly fifty cases runs on Linux and macOS in CI, MIT licensed. Against that, the documentation disagrees with the code in places that matter to a security tool, which keeps the verdict mixed.

What's good

The agent cannot switch it off. Disabling requires an interactive terminal, a typed confirmation and a token signed with a secret created at install time, and it expires after 30 minutes. Attempts from a non-interactive shell are logged as bypass attempts. Installs are staged and rolled back if any probe fails, including a check that a harmless file write is still allowed. The test cases go beyond the obvious: absolute binary paths, busybox and env wrappers, SQL deletes hidden behind comments, and broad WHERE clauses that still touch every row.

Tradeoffs

Protection is regular-expression matching on command text, so it catches the forms it anticipates, not arbitrary ones. The database rule only runs when the command names the Postgres command-line client. The guard catalogue lists default protected paths that differ from the defaults the code ships, and it counts 18 core guards where only 13 load; nine, including the loop detector, sit in the repository unused, yet the comparison table credits loop detection. Only Claude Code is supported today. The installer closes with a star request and a book plug, and Pro features check a remote licence server.

How to use it well

Fits a solo developer or small team running Claude Code with real credentials on the machine, who wants a cheap backstop against a pushed main branch, a recursive delete or a key posted to a request-capture site. Set your own protected tables, branches and paths in the config file rather than trusting the documented defaults, then run the built-in attack simulation to see what actually trips. Treat it as one layer: it does not sandbox the agent, and it does nothing for Codex or Gemini users yet.

Observed

License

MIT (LICENSE, package.json)

Language

Bash, with jq and openssl as runtime requirements

Install surface

npm package guardrail-agent exposing a guardrail CLI; npx guardrail-agent init

Platform support

Linux and macOS (package.json os field; CI matrix ubuntu-latest and macos-latest in .github/workflows/ci.yml)

Agent support

Claude Code hooks only; Codex CLI and Gemini CLI adapters described as planned

Failure mode

Fail-closed: malformed payloads and guard load or runtime errors deny the command (dispatchers/pre-bash.sh)

Tests

Adversarial dispatcher suite in tests/adversarial.sh, run by npm test in CI

Core guards loaded

13 installed by install.sh; nine further guard files in the repository are not loaded by any dispatcher (README.md)

Documentation drift

docs/guards.md default protected paths differ from lib/guardrail-common.sh defaults

Paid tier

Pro guards gated by a licence key validated against a remote API (lib/guardrail-license.sh)