@ruah-dev/guard

Guard

Can I trust the agent not to do damage — in any harness, with proof?

One deterministic policy file. The same verdict in Claude Code, Codex, Cursor, and CI, backed by a bypass-attempt test suite. Portable and testable — not just another rm -rf blocker.

Source

See it

Quick start

Up and running in seconds

@ruah-dev/guard
$ ruah guard check --cmd 'rm -rf /' --json
# { "decision": "deny", "ruleId": "deny-rm-root" }

Features

01Sub-50ms deterministic command verdicts
02High-entropy secret scanner (sk_live, AWS, PEM)
03Drop-in Claude Code PreToolUse hook adapter
04Allow, Deny, and Interactive 'Ask' actions
05Audit trail logging (.ruah/guard-audit.jsonl)
06Zero runtime dependencies & zero network latency

<50ms

Deny verdict

0

Runtime deps

ask

Approval action

Command Reference

Commands

ruah guard check --cmd <cmd>Evaluate policy verdict for a command
ruah guard check --file <diff>Scan staged diff for credentials & secrets
ruah guard hook claude-codeGenerate or install agent hook adapter
ruah guard audit --last 50Inspect recent allow/deny policy decisions
ruah guard initScaffold starter .ruah/guard.json policy

Dive deeper

Full API reference, guides, and examples.