CC Safety Net plugin
A guard for coding agents: blocks destructive Git and file system commands and attempts to read sensitive files before they run
- 2,014 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Installs as a hook that runs before every agent command and parses it
- Blocks dangerous Git and file system operations and sends nothing out
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/cc-safety-netDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Installs as a hook that runs before every agent command and parses it
- Blocks dangerous Git and file system operations and sends nothing out
This is third-party code. Review the repository files before installing.
What it does
CC Safety Net hooks into a coding agent and checks a command before it runs. It stops dangerous Git and file system operations and attempts to read sensitive files such as keys and settings. Rules are configurable: some blocks can be turned off, allow and deny paths can be added, and there is a policy GUI. The installer supports more than a dozen coding agents and picks the right integration for each.
Who it is for. For developers and devops engineers who give a coding agent terminal access and want a safety net.
Good fit when
- The agent runs commands in your repository
- You need to block dangerous commands and secret reads
- You want unified safety rules across several agents
Not a fit when
- The agent does not run commands at all
- You need full audit and monitoring rather than on-the-fly blocking
Example request
Install CC Safety Net into my Claude Code and enable blocking of dangerous Git commandsLimitations
It guards against accidental destructive actions, not a full sandbox: it reduces risk but does not replace least privilege and backups. Compatibility with specific agent versions is listed in the README.
How to disable. Run npx -y cc-safety-net uninstall or remove the plugin through your agent's tools.
FAQ
Can I disable individual rules?
Yes, some blocks can be turned off in the policy screen, and you can add allow and deny paths. A few core rules cannot be turned off.
Which agents does it support?
A set of coding agents including Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI and OpenCode; the full list is in the README.
Discussion
No questions or reviews yet.
Related
Pluginsdcg is an agent command-checking hook that explains matched rules; a disputed command can be examined without executing it.
AgentGuard checks a coding agent's actions before they run and scans third-party skills for secrets, backdoors and injections.
A local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
Security hook for coding agents: scores each tool call with session context and flags injections in results and skills
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| CC Safety Net (this card) | no | 2,014 | |
| HOL Guard | yes | 1,094 | checks commands, secrets and package installs before they run |
| Claude Code mods | no | 471 | a set of Claude Code mods |
| Sage | yes | 326 | a plugin that checks the commands |
README in short
The README describes CC Safety Net as a pre-execution check for coding agents. Installation uses npx with an install command, plus update and uninstall, and commands status, doctor, explain and logs. Rules are configured in a policy GUI and via a rule add command. It lists supported agents and notes on OpenCode integration.