@ruah-dev/guard
Guard
Can I trust the agent not to do damage — in any harness, with proof?
One deterministic policy file. The same verdict in Claude Code, Codex, Cursor, and CI, backed by a bypass-attempt test suite. Portable and testable — not just another rm -rf blocker.
See it
Quick start
Up and running in seconds
@ruah-dev/guard
$ ruah guard check --cmd 'rm -rf /' --json
# { "decision": "deny", "ruleId": "deny-rm-root" }Features
01Sub-50ms deterministic command verdicts
02High-entropy secret scanner (sk_live, AWS, PEM)
03Drop-in Claude Code PreToolUse hook adapter
04Allow, Deny, and Interactive 'Ask' actions
05Audit trail logging (.ruah/guard-audit.jsonl)
06Zero runtime dependencies & zero network latency
<50ms
Deny verdict
0
Runtime deps
ask
Approval action
Command Reference
Commands
ruah guard check --cmd <cmd>Evaluate policy verdict for a commandruah guard check --file <diff>Scan staged diff for credentials & secretsruah guard hook claude-codeGenerate or install agent hook adapterruah guard audit --last 50Inspect recent allow/deny policy decisionsruah guard initScaffold starter .ruah/guard.json policyEcosystem
Part of the ruah toolchain
CLI Router
@ruah-dev/cli
One command. Every agent tool.
Verify
@ruah-dev/verify
Did the agent actually finish?
Optimizer
@ruah-dev/opt
Where did my tokens go?
Watch (Lite)
@ruah-dev/watch
Can I show someone what this session did?
Eval
@ruah-dev/eval
Same task — which executor wins, and what did it cost?
Converter
@ruah-dev/conv
How do I make this API agent-sized?
Orchestrator
@ruah-dev/orch
Parallel agents. Zero collisions.