{
  "markdown": "<div align=\"center\">\n<pre>\n╦═╗ ╔═╗ ╦ ╦   ╔═╗ ╦ ╦ ╔═╗ ╦═╗ ╔╦╗\n╠╦╝ ╠═╣ ║ ║   ║ ╦ ║ ║ ╠═╣ ╠╦╝  ║║\n╩╚═ ╩ ╩ ╩ ╩═╝ ╚═╝ ╚═╝ ╩ ╩ ╩╚═ ═╩╝\n</pre>\n</div>\n\n<p align=\"center\">\n  <strong>Safe runtime for Claude Code, built to be yours.</strong><br>\n  <a href=\"https://railguard.tech\">railguard.tech</a>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://crates.io/crates/railguard\"><img src=\"https://img.shields.io/crates/v/railguard.svg\" alt=\"crates.io\"></a>\n  <a href=\"https://github.com/railyard-dev/railguard/stargazers\"><img src=\"https://img.shields.io/github/stars/railyard-dev/railguard?style=flat\" alt=\"GitHub stars\"></a>\n  <a href=\"https://opensource.org/licenses/MIT\"><img src=\"https://img.shields.io/badge/license-MIT-blue.svg\" alt=\"License: MIT\"></a>\n  <img src=\"https://img.shields.io/badge/tests-151%20passed-brightgreen\" alt=\"Tests\">\n  <img src=\"https://img.shields.io/badge/built%20with-Rust-orange.svg\" alt=\"Built with Rust\">\n  <a href=\"https://discord.gg/MyaUZSus\"><img src=\"https://img.shields.io/badge/discord-join-7289da.svg\" alt=\"Discord\"></a>\n</p>\n\n---\n\n## The problem\n\n--dangerously-skip-permissions is all-or-nothing. Either you approve every tool call by hand, or Claude runs with zero restrictions. There's no middle ground.\n\nRailguard is the middle ground.\n\n```\ncargo install railguard\nrailguard install\n```\n\nThat's it. Keep using Claude exactly as before.\n\n---\n\n## What it does\n\nRailguard intercepts every tool call and decides in under 2ms: allow, block, or ask.\n\n| | |\n|---|---|\n| npm install && npm run build | ✅ allowed |\n| git commit -m \"feat: add auth\" | ✅ allowed |\n| terraform destroy --auto-approve | ⛔ blocked |\n| rm -rf ~/ | ⛔ blocked |\n| echo payload \\| base64 -d \\| sh | ⛔ blocked |\n| cat ~/.ssh/id_ed25519 | ⛔ blocked |\n| curl -X POST api.com -d @secrets | ⚠️ asks you |\n| git push --force origin main | ⚠️ asks you |\n\nThe same command can get different decisions depending on context:\n\n| | | |\n|---|---|---|\n| rm dist/bundle.js | inside project | ✅ allowed |\n| rm ~/.bashrc | outside project | ⛔ blocked |\n\n99% of commands flow through instantly. You only see Railguard when it matters.\n\n---\n\n## What it guards\n\nEvery tool call passes through Railguard, not just Bash.\n\n- **Bash** · command classification, pipe analysis, evasion detection\n- **Read** · sensitive path detection (~/.ssh, ~/.aws, .env, ...)\n- **Write** · path fencing + content inspection for secrets and dangerous payloads\n- **Edit** · path fencing + content inspection on replacements\n- **Memory** · classification of agent memory writes for secrets, behavioral injection, tampering\n\n---\n\n## Beyond pattern matching\n\nPattern matching alone is bypassable. Agents can write helper scripts, encode commands in base64, or chain pipes to evade rules. Railguard uses sandbox-exec (macOS) and bwrap (Linux) to resolve what actually executes at the kernel level, regardless of how the command was constructed.\n\nTwo layers: semantic rules catch the obvious stuff instantly. The OS-level sandbox catches everything else.\n\n---\n\n## Memory safety\n\nClaude Code has persistent memory that carries context across sessions. This is a real attack surface. A misbehaving agent can exfiltrate secrets into memory, inject behavioral instructions for future sessions, or silently tamper with existing memories.\n\nRailguard classifies every memory write:\n\n- **Secrets** (API keys, JWTs, private keys, AWS credentials) → **blocked**\n- **Behavioral instructions** (\"skip safety checks\", \"override policy\") → **asks you**\n- **Factual content** (project info, tech stack, user preferences) → **allowed**\n- **Overwrites of existing memories** → **asks you**\n- **Deletions** → **blocked**\n\nEvery memory write is signed with a content hash. Tampering between sessions is detected automatically.\n\n---\n\n## Configure\n\nAsk Claude, or edit railguard.yaml directly. Changes take effect immediately.\n\n```yaml\nblocklist:\n  - name: terraform-destroy\n    pattern: \"terraform\\\\s+destroy\"\n\napprove:\n  - name: terraform-apply\n    pattern: \"terraform\\\\s+apply\"\n\nallowlist:\n  - name: terraform-plan\n    pattern: \"terraform\\\\s+plan\"\n```\n\n---\n\n## Also included\n\n- **Path fencing** · ~/.ssh, ~/.aws, ~/.gnupg, /etc fenced by default\n- **Multi-agent coordination** · file locking per session, self-healing locks\n- **Dashboard & replay** · real-time monitoring, session replay\n- **Recovery** · file snapshots, per-edit or full-session rollback\n\n---\n\n## Contributing\n\n[Join the Discord](https://discord.gg/MyaUZSus)\n\nMIT License.\n",
  "bytes": 4468,
  "sha": "6e2beb55c4aea0bc41460f9269afad60dff4b1197e565ddc1ea68689ed8658d7",
  "repo_slug": "railyard-dev/railguard",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_railyard_dev_railguard_railguard_ccd9610a/readme"
}