{
  "markdown": "# 🛡️ DeployShield\n\n[![Tests](https://github.com/matanryngler/deployshield/actions/workflows/test.yml/badge.svg)](https://github.com/matanryngler/deployshield/actions/workflows/test.yml)\n[![Release](https://img.shields.io/github/v/release/matanryngler/deployshield)](https://github.com/matanryngler/deployshield/releases)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Python Support](https://img.shields.io/badge/python-3.9%2B-blue.svg)](https://www.python.org/downloads/)\n\n**DeployShield** is a cross-platform production safety guardrail for **Claude Code** and **Gemini CLI**. It intercepts terminal commands before execution and blocks dangerous operations (writes, deletes, etc.) while allowing read-only commands to pass through.\n\n## 🚀 Why DeployShield?\n\nLarge Language Models (LLMs) are incredibly capable but can accidentally execute destructive commands in production environments. DeployShield provides a **deterministic safety layer** that doesn't rely on probabilistic model instructions.\n\n- **Deterministic Protection**: Uses a curated safe-list of read-only subcommands.\n- **Recursive Safety**: Deeply scans subshells, backticks, `sudo`, and `bash -c`.\n- **Context-Aware**: Granular control—block writes in `production` while allowing them in `dev`.\n- **Zero-Dependency**: Fast, lightweight, and runs on any system with Python 3.8+.\n\n---\n\n## 🛠️ Supported Providers\n\n| Category | Guarded CLIs |\n| :--- | :--- |\n| **☁️ Cloud** | `aws`, `gcloud`, `az`, `kubectl`, `helm` |\n| **🗄️ Databases** | `psql`, `mysql`, `mongosh`, `redis-cli` |\n| **🏗️ IaC** | `terraform`, `pulumi`, `cdk`, `sam`, `serverless` (`sls`), `ansible-playbook` |\n| **📦 Publishing** | `npm`, `yarn`, `pnpm`, `cargo`, `twine`, `gem` |\n| **🔧 Other** | `vault`, `gh`, `docker`, `podman` |\n\n---\n\n## 📥 Installation\n\n### **Claude Code**\n1. Register the marketplace:\n   ```bash\n   /plugin marketplace add matanryngler/deployshield\n   ```\n2. Install the plugin:\n   ```bash\n   /plugin install deployshield\n   ```\n\n### **Gemini CLI**\n1. Install directly via GitHub:\n   ```bash\n   gemini extensions install https://github.com/matanryngler/deployshield\n   ```\n\n---\n\n## ⚙️ Context-Aware Blocking\n\nBy default, DeployShield blocks ALL write operations. Create a `.deployshield.json` file to allow writes in non-production contexts.\n\n### Use Cases\n\n- **🛡️ Safe Local Development**: Allow destructive commands on your local machine or dev clusters, but keep the guardrails on for anything that touches production.\n- **🤝 Team-Wide Guardrails**: Commit a `.deployshield.json` to your project repository to ensure that every developer follows the same safety standards.\n- **🏗️ CI/CD Migration**: Force changes through PRs by blocking manual applies in production environments.\n\n### Examples\n\n```json\n{\n  \"kubectl\": [\"prod-cluster\", \"production\", \"prod-*\"],\n  \"aws\": [\"production-profile\"],\n  \"terraform\": [\"prod-workspace\"]\n}\n```\n\nFor detailed configuration options, see the **[Configuration Guide](docs/configuration.md)**.\n\n---\n\n## 🛡️ Recursive Safety\n\nDeployShield provides deep protection that handles common bypass attempts:\n- **Nested Subshells**: `echo $(terraform destroy)` → **Blocked**\n- **Administrative Wrappers**: `sudo kubectl delete ...` → **Blocked**\n- **Execution Wrappers**: `echo pod-id | xargs kubectl delete pod` → **Blocked**\n- **Shell Wrappers**: `bash -c \"aws s3 rm ...\"` → **Blocked**\n- **Process Substitution**: `cat <(pulumi destroy)` → **Blocked**\n\n---\n\n## 🤝 Contributing\n\nThis project uses **`uv`** for dependency management and **`pre-commit`** for quality control.\n\nTo understand how DeployShield works under the hood, check the **[Internals Guide](docs/internals.md)**.\n\n```bash\n# Run tests\nuv run pytest -v\n\n# Install pre-commit hooks\nuv run pre-commit install\n```\n\n### License\nMIT\n",
  "bytes": 3849,
  "sha": "aa4ae46dd404e5e02ea4d618cc537d9139a22cd3802ba7dd33878865e9ccc778",
  "repo_slug": "matanryngler/deployshield",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_matanryngler_deployshield_deployshield_985a1bb4/readme"
}