railguard vs. guard

Railguard is a safer, context-aware alternative to --dangerously-skip-permissions for Claude Code. Instead of choosing between approving every command manually or giving Claude unrestricted access, Railguard sits in the middle. It intercepts every tool call — Bash, Write, Edit, Read — and makes policy-based decisions: allow safe commands instantly, block dangerous ones automatically, and ask for human approval when it's not sure. Out of the box, Railguard comes with 29 default rules covering destructive operations like terraform destroy, rm -rf, DROP TABLE, and git force-push. It detects evasion attempts (base64 encoding, chr construction, variable substitution, shell wrapping), restricts file access with path fencing (blocking ~/.ssh, ~/.aws, /etc), snapshots every file write for one-click rollback, and logs every decision to a structured audit trail. Everything is customizable through a simple railguard.yaml file in your project directory.

PreToolUse hooks for Claude Code that deny dangerous shell, git, and credential commands before they run: `rm -rf /` shapes, `git push --force`, `python -c` / `node -e` eval, pipe-to-shell, live credentials (`gh auth token`, `aws sts get-session-token`, `op read`), `git -c core.hooksPath=…` injection, silent commit reuse (`git commit -C HEAD~1`, `--reuse-message`). Each deny names the rule and prints a one-line override (`guard allowlist allow-command …`); decisions stream to a JSONL log the optional CLI reads (`pipx install tracine-guard`, then `guard noisy --since 24h` or `guard trace <session>`). Apache-2.0, no third-party deps. Defense in depth alongside Claude Code's own permissions — especially valuable for autonomous agent windows where no human is present to answer an ASK, so denies act as a hard floor. Not a sandbox or exfiltration boundary; see SECURITY.md.