Guardrails and an audit trail for teams adopting coding agents

A free Claude Code plugin that blocks destructive shell commands, secret leaks and edits to protected paths. It logs every decision and prints a report you can hand to a reviewer.

Install free Team Pack £24

Built by a UK engineer who uses AI agents with human review. Runs on Claude Code. Not affiliated with or endorsed by Anthropic.

The problem

Coding agents are fast. They also run real commands in real repos. These are hypothetical examples, not customer stories.

Hypothetical example 1: the tidy-up

An agent is asked to clean build output. It builds a path from an empty variable and runs rm -rf against the wrong directory. Nobody reads the command before it runs.

Hypothetical example 2: the helpful debug

An agent is chasing a failing API call. It prints the environment to the terminal and pastes the output, API keys included, into a commit message or a pull request description.

Hypothetical example 3: the "small" edit

An agent fixes a failing deploy by editing the CI workflow and a lockfile. Those files are protected by team convention. Nothing in the tooling says so.

Each of these is cheap to prevent. Few teams have the rules written down in a form the agent cannot skip.

How it works

Install. Add the plugin to Claude Code. Pick a starter policy: strict-fintech, oss-maintainer or agency-client-work.
Run as normal. Hooks check each shell command and file edit before it runs. Risky ones are blocked, with the reason shown to the agent.
Review. Every decision goes into an audit log. Run the report command to see what was blocked, what was allowed and why.

Install

Local, from a clone:

claude --plugin-dir ./agent-guardrails

From a marketplace, once published:

/plugin marketplace add RichFloForge/agent-guardrails
/plugin install agent-guardrails@agent-guardrails-marketplace

Then, in your project, optionally create a config. Defaults work with no config. Requires python3 on the PATH.

/agent-guardrails:init --policy strict-fintech

Config lives in .claude/guardrails.json and is merged over the defaults, so you only write what you change:

{
  "fail_closed": false,
  "protected_branches": ["main", "master", "production"],
  "rules": {
    "destructive_shell": { "mode": "block" },
    "scope_shell": {
      "enabled": true,
      "mode": "warn",
      "blocked_commands": ["npm publish", "terraform apply"]
    }
  }
}

What it blocks

Animated terminal recording of the real hook output: git reset --hard, a piped remote script and a write to .env are blocked with the rule name and how to allow it; npm test is allowed and logged; the report command summarises the session. — Recorded from the real hook and report scripts; invocation lines shortened for display.

Terminal transcript: an agent proposes rm -rf on a home-directory path and the hook blocks it with the rule name and how to allow it; a second attempt to write an AWS key into src/config.py is blocked by the secrets rule.

Destructive shell commands: rm -rf of /, ~, . or *; force-push or deletion of protected branches; git reset --hard; git clean -fd; DROP TABLE/DATABASE; truncate; mkfs; dd if=; chmod -R 777; curl | sh; fork bombs.
Secrets written into files: AWS keys, private key headers, GitHub tokens, Slack tokens, Stripe live keys and api_key/secret/password/token assignments. Values are never printed or logged.
Edits to protected paths: .env, .env.*, *.pem, *.key, id_rsa*, .git/**, secrets/ and any paths you add.
Commands your team has banned: optional, off by default. For example npm publish or terraform apply.
Audit log: every tool call goes to a local JSONL file, with a report command.

Limits: hooks only see tool calls Claude Code makes. This is not a sandbox, and pattern matching can be bypassed by obfuscation. It is one layer, not a full security boundary. You still need review and backups.

Free plugin vs Team Pack

Feature comparison of the free plugin and the Team Pack
Feature	Free plugin (open source)	Team Pack (£24 one-time)
Blocks destructive shell commands	Yes	Yes
Secret-leak detection	Yes	Yes
Protected-path rules	Yes	Yes
Audit log and report	Yes	Yes
Starter policies	3	3 plus 8 additional packs
Extra packs: regulated/fintech, healthcare data, monorepo, data-science notebooks, infra/terraform, mobile, open-source maintainer, agency	No	Yes
CLAUDE.md templates for teams	No	Yes
10-page rollout playbook (introducing agents safely, review gates, cost controls)	No	Yes
Email support	Community issues	30 days by email
Licence	MIT	Personal and team use within your organisation, per Terms

Team Pack price: £24 total, one-time. VAT not charged (not VAT registered). Sold through Gumroad, which is the Merchant of Record.

Team Pack £24 Install free

Services

Fixed scope. Written quote. 50% deposit, remainder on delivery. UK clients to start. Prices are totals; VAT not charged (not VAT registered). Work is done by the operator with AI agents and reviewed by a human before delivery.

Agent-ready repo setup

£249

CLAUDE.md, guardrails policy, hooks, skills, CI check, 30-minute handover call.

3 working days from deposit and access.

Custom MCP server

£449

One internal API, up to 8 tools, tests, docs, deployment notes.

5 working days from deposit and access.

Zapier/Make to n8n migration

£349

Up to 5 workflows, self-hosted or n8n cloud, handover document.

5 working days from deposit and access.

See scope and request a quote

FAQ

Does the free plugin cost anything?

No. It is open source. The Team Pack is optional.

Can I get a refund on the Team Pack?

Yes, within 14 days if you have not downloaded it. After download, refunds are considered case by case. See the Refund Policy. This does not affect your statutory rights.

Do you use AI to build this?

Yes. The operator uses AI agents to draft code and documents, then reviews, tests and edits them. A human is responsible for everything shipped.

What data does the plugin collect?

The plugin runs locally. The audit log stays on your machine. It does not send your code or commands anywhere. No network calls, no telemetry. The audit log is written locally. See the Privacy Notice.

What licence is the plugin under?

MIT. Check the repository for the current text.

Does this guarantee an agent can never do harm?

No. It reduces risk by blocking known-bad patterns and recording what happens. It is one layer, not a full security boundary. You still need review and backups.

Does it work with tools other than Claude Code?

No. It is a Claude Code plugin, using its hooks and slash commands.

Who is behind this?

Agent Guardrails, a UK sole trader. Contact: hello@agentguardrails.app.