SolonGate Agent Security CLI
A local security gateway for Claude Code and Codex: checks tool calls against a policy, catches secrets and keeps an audit trail
- 155 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Writes hooks into Claude Code and Codex settings and adds a shim on outbound requests, seeing the content of every call
- Controls policy, the sandbox and path protection with the power to refuse any agent call
Install
- Works in
Manual install
git clone https://github.com/solongate/agent-security.gitThen run `./scripts/install.sh` and `solongate` from the repository folder. Needs git and Go 1.26; install.sh downloads the Go build from go.dev if it is missing.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Writes hooks into Claude Code and Codex settings and adds a shim on outbound requests, seeing the content of every call
- Controls policy, the sandbox and path protection with the power to refuse any agent call
This is third-party code. Review the repository files before installing.
What it does
SolonGate Agent Security checks a coding agent's actions before they run. Through hooks it receives every tool call and matches it against a policy: it allows or denies by path, command, filename or URL, separately for READ, WRITE, EXECUTE and NETWORK. The policy is a file and so is the audit trail, the program makes no network calls, and no account or telemetry is needed. Protection comes in layers. DLP knows more than 70 secret patterns and has four modes: `off`, `detect`, `redact`, `block`. In block mode the gateway refuses an upload if the file holds a secret, which the text of the call alone cannot reveal. Rate limits set a cap per minute, hour or day. For Claude Code a shim masks the outbound request body, which a tool-call hook cannot reach. There is tamper protection: the gateway's own state is unreachable from a tool call, and a policy in a repository cannot switch it off. Protected paths are refused by the OS itself, and sandbox mode gives the agent a minimal filesystem holding only the project. The commands `solongate`, `policy`, `dlp`, `audit`, `watch`, `trace` and `doctor` show and edit all of this from the terminal.
Who it is for. Developers who give Claude Code or Codex broad rights on a work machine and want to shut down `.env` reads, key leaks and stray network calls in advance.
Good fit when
- The agent reaches for `.env` and access to it must be closed by a policy rule
- Keys slip into code and logs and you need DLP in `redact` or `block` mode
- You want to cap the agent's calls per minute or per day
- You need a log of every tool call, browsable with `solongate audit` and `solongate watch`
- The agent should run in a minimal filesystem that holds only the project, which `solongate sandbox` provides
Not a fit when
- You need one central policy for a whole organisation: the gateway is local and works on one machine
- The agent is not on the supported list and has no hooks
- You have no Git and cannot build a Go project: installation runs from a cloned repository
Example request
Install SolonGate Agent Security, close reads of .env and turn DLP to block mode, then show in solongate audit that the request was refusedLimitations
- Installation builds a Go 1.26 or newer project. If Go is missing, `install.sh` downloads the official build from go.dev.
- Hooks load when a session starts, so an already open session stays unguarded until restarted.
- The README shows supported agents as images without a capability table. Going by the repository topics and the example in the text, these are Claude Code and Codex.
- Secret detection relies on patterns, so a non-standard key can slip past the gateway.
How to disable. `solongate repair` restores the gateway, hooks and settings; to disable it, remove SolonGate's hooks from the agent settings and delete the installed `solongate` binary and its state folder. Protected paths and sandboxes are lifted through `solongate policy protect` and `solongate sandbox`.
FAQ
How do I install SolonGate Agent Security?
Clone the repository, run `./scripts/install.sh` from its folder and then `solongate`. Open a new terminal afterwards, otherwise the open agent session stays without hooks.
How is SolonGate different from cc-safety-net?
cc-safety-net blocks destructive Git and filesystem commands. SolonGate builds a policy by path, command and URL and includes DLP with 70-plus patterns, rate limits, an audit trail and a sandbox.
Does my data leave the machine?
No: the policy and audit trail are files and the gateway itself makes no network calls. No account or telemetry is needed.
What does DLP block mode do?
The gateway refuses an upload when the file holds a secret. Pattern matching on the call text cannot see that case, so the check reads the file contents.
What is sandbox mode?
`solongate sandbox 001 claude` starts the agent inside a new minimal filesystem holding only the project. Everything else is simply absent, so there is nothing to read and nothing to forbid with rules.
Discussion
No questions or reviews yet.
Related
CLI toolsA policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
A local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
Claude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| SolonGate Agent Security (this card) | no | 155 | |
| CC Safety Net | no | 1,932 | blocks destructive Git and filesystem commands |
| HOL Guard | yes | 1,072 | checks packages and MCP calls, with a human deciding through an approval queue |
README in short
The README briefly introduces the gateway and promises local operation with no account and no telemetry. Next come an install from a clone, an example of a `.env` block in Claude Code, a table of eight protection layers and a CLI command reference. The page closes with a supported agents list and a contributors table; OpenSSF and SLSA badges sit at the top.