railguard
Railguard is a safer, context-aware alternative to --dangerously-skip-permissions for Claude Code. Instead of choosing between approving eve
Open source Repository Open in the app JSON README (API)
About
Railguard is a safer, context-aware alternative to --dangerously-skip-permissions for Claude Code. Instead of choosing between approving every command manually or giving Claude unrestricted access, Railguard sits in the middle. It intercepts every tool call — Bash, Write, Edit, Read — and makes policy-based decisions: allow safe commands instantly, block dangerous ones automatically, and ask for human approval when it's not sure. Out of the box, Railguard comes with 29 default rules covering destructive operations like terraform destroy, rm -rf, DROP TABLE, and git force-push. It detects evasion attempts (base64 encoding, chr() construction, variable substitution, shell wrapping), restricts file access with path fencing (blocking ~/.ssh, ~/.aws, /etc), snapshots every file write for one-click rollback, and logs every decision to a structured audit trail. Everything is customizable through a simple railguard.yaml file in your project directory.
Details
- Kind
- Plugins
- Topic
- Cloud & DevOps
- Publisher
- railyard-dev
- Origin
- marketplace
- Category
- ferramentas
- Stars
- 38
- Forks
- 5
- Last push
- 2026-03-23T00:35:14Z
- Repository state
- ativo
- Language
- Rust
- License
- MIT
- Added
- 2026-08-30 01:48:58
- Updated
- 2026-08-30 01:48:58
- Origin id
railyard-dev/railguard/railguard
README
<div align="center">
<pre>
╦═╗ ╔═╗ ╦ ╦ ╔═╗ ╦ ╦ ╔═╗ ╦═╗ ╔╦╗
╠╦╝ ╠═╣ ║ ║ ║ ╦ ║ ║ ╠═╣ ╠╦╝ ║║
╩╚═ ╩ ╩ ╩ ╩═╝ ╚═╝ ╚═╝ ╩ ╩ ╩╚═ ═╩╝
</pre>
</div>
<p align="center">
<strong>Safe runtime for Claude Code, built to be yours.</strong><br>
<a href="https://railguard.tech">railguard.tech</a>
</p>
<p align="center">
<a href="https://crates.io/crates/railguard"><img src="https://img.shields.io/crates/v/railguard.svg" alt="crates.io"></a>
<a href="https://github.com/railyard-dev/railguard/stargazers"><img src="https://img.shields.io/github/stars/railyard-dev/railguard?style=flat" alt="GitHub stars"></a>
<a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT"></a>
<img src="https://img.shields.io/badge/tests-151%20passed-brightgreen" alt="Tests">
<img src="https://img.shields.io/badge/built%20with-Rust-orange.svg" alt="Built with Rust">
<a href="https://discord.gg/MyaUZSus"><img src="https://img.shields.io/badge/discord-join-7289da.svg" alt="Discord"></a>
</p>
---
## The problem
--dangerously-skip-permissions is all-or-nothing. Either you approve every tool call by hand, or Claude runs with zero restrictions. There's no middle ground.
Railguard is the middle ground.
```
cargo install railguard
railguard install
```
That's it. Keep using Claude exactly as before.
---
## What it does
Railguard intercepts every tool call and decides in under 2ms: allow, block, or ask.
| | |
|---|---|
| npm install && npm run build | ✅ allowed |
| git commit -m "feat: add auth" | ✅ allowed |
| terraform destroy --auto-approve | ⛔ blocked |
| rm -rf ~/ | ⛔ blocked |
| echo payload \| base64 -d \| sh | ⛔ blocked |
| cat ~/.ssh/id_ed25519 | ⛔ blocked |
| curl -X POST api.com -d @secrets | ⚠️ asks you |
| git push --force origin main | ⚠️ asks you |
The same command can get different decisions depending on context:
| | | |
|---|---|---|
| rm dist/bundle.js | inside project | ✅ allowed |
| rm ~/.bashrc | outside project | ⛔ blocked |
99% of commands flow through instantly. You only see Railguard when it matters.
---
## What it guards
Every tool call passes through Railguard, not just Bash.
- **Bash** · command classification, pipe analysis, evasion detection
- **Read** · sensitive path detection (~/.ssh, ~/.aws, .env, ...)
- **Write** · path fencing + content inspection for secrets and dangerous payloads
- **Edit** · path fencing + content inspection on replacements
- **Memory** · classification of agent memory writes for secrets, behavioral injection, tampering
---
## Beyond pattern matching
Pattern matching alone is bypassable. Agents can write helper scripts, encode commands in base64, or chain pipes to evade rules. Railguard uses sandbox-exec (macOS) and bwrap (Linux) to resolve what actually executes at the kernel level, regardless of how the command was constructed.
Two layers: semantic rules catch the obvious stuff instantly. The OS-level sandbox catches everything else.
---
## Memory safety
Claude Code has persistent memory that carries context across sessions. This is a real attack surface. A misbehaving agent can exfiltrate secrets into memory, inject behavioral instructions for future sessions, or silently tamper with existing memories.
Railguard classifies every memory write:
- **Secrets** (API keys, JWTs, private keys, AWS credentials) → **blocked**
- **Behavioral instructions** ("skip safety checks", "override policy") → **asks you**
- **Factual content** (project info, tech stack, user preferences) → **allowed**
- **Overwrites of existing memories** → **asks you**
- **Deletions** → **blocked**
Every memory write is signed with a content hash. Tampering between sessions is detected automatically.
---
## Configure
Ask Claude, or edit railguard.yaml directly. Changes take effect immediately.
```yaml
blocklist:
- name: terraform-destroy
pattern: "terraform\\s+destroy"
approve:
- name: terraform-apply
pattern: "terraform\\s+apply"
allowlist:
- name: terraform-plan
pattern: "terraform\\s+plan"
```
---
## Also included
- **Path fencing** · ~/.ssh, ~/.aws, ~/.gnupg, /etc fenced by default
- **Multi-agent coordination** · file locking per session, self-healing locks
- **Dashboard & replay** · real-time monitoring, session replay
- **Recovery** · file snapshots, per-edit or full-session rollback
---
## Contributing
[Join the Discord](https://discord.gg/MyaUZSus)
MIT License.