Failproof AI CLI
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
- 8,668 ★ on the repository
- Last commit
Extended access
Why this level
- It intercepts and can block tool calls across all connected agents
- Some features tie into a cloud dashboard and the Python SDK
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/failproof-aiDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- It intercepts and can block tool calls across all connected agents
- Some features tie into a cloud dashboard and the Python SDK
This is third-party code. Review the repository files before installing.
What it does
Failproof hooks into agent harnesses, including Claude Code, Codex, Cursor Agent CLI, OpenCode and GitHub Copilot CLI, and intercepts every tool call before it runs. It ships with 39 built-in policies: blocking reads of secret files, recursive deletion, sudo, force pushes and direct pushes to the main branch, plus warnings for repeated calls and dangerous SQL. Custom policies are JS files dropped into .failproofai/policies and picked up automatically; a local dashboard at localhost:8020 shows the run history.
Who it is for. For developers and devops engineers who give AI agents terminal access and want a safety net against destructive commands.
Good fit when
- The agent works on a production repo or infrastructure and needs a guard before dangerous commands
- The team wants a shared policy set applied the same way for everyone via a committed .failproofai folder
- You need one run history across agents for incident review
Not a fit when
- The agent runs in a disposable isolated sandbox with nothing to protect
- The harness in use is not among the twelve supported ones
Example request
Set up failproofai for Claude Code and enable the policy blocking force push and rm -rfLimitations
Blocking a tool call before it runs is guaranteed on all twelve harnesses, while end-of-turn gates work on only eight of them. Custom agents outside the list connect via a separate Python SDK and need a hook in their own runtime to be intercepted.
How to disable. Remove the package with npm uninstall -g failproofai. The base block-failproofai-commands policy cannot be disabled while the package is installed; that is intentional.
FAQ
What happens right after install?
The hooks are wired up, but no policy is selected besides the non-disableable block on failproofai's own commands. Policies must be added with a separate command.
How do I add a custom policy?
Drop a JS file into .failproofai/policies; it is picked up automatically and ships with the repo on commit.
Discussion
No questions or reviews yet.
Related
CLI toolsai-engineering installs hooks that deny risky agent calls and write a receipt for every verdict into your repository
A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
A local security gateway for Claude Code and Codex: checks tool calls against a policy, catches secrets and keeps an audit trail
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
README in short
The README describes failproofai as observability and enforcement across twelve AI agent harnesses: ten coding CLIs and two chat gateways. It highlights one policy API and one session history across all harnesses, while blocking capability varies by harness. It lists built-in policies like block-rm-rf, block-sudo, block-force-push and warn-destructive-sql, and shows a custom-policy example via a JS deny/allow function.