Guides
Command guard
Stop coding agents from running destructive commands — rm -rf of your home directory, database resets, force pushes, infrastructure teardown, secrets sent over the network. A local Claude Code hook, no API key needed.
Agents have wiped home directories (rm -rf $DIR/ after a variable from an earlier shell call was gone),
production databases and cloud resources. The command guard reads every Bash command before it runs and stops the
ones that destroy data. It runs locally and offline — nothing is sent anywhere — and it is the same hook as the
package guard, so one setup covers both.
Denied — never runs
| Command | Why |
|---|---|
rm -r / rm -rf of /, your home directory, a parent of it, or a system directory (/usr, /etc, /System…) | catastrophic, never what an agent should do |
a recursive delete whose path uses a variable that is not set (rm -rf $BUILD_DIR/) | it may expand to rm -rf / — the classic agent incident |
rm -rf /*, ~/* | deletes everything |
mkfs, dd of=/dev/…, writing to a disk device | overwrites a disk |
chmod -R / chown -R on / or your home | breaks the system |
cat .env | curl …, curl -F file=@.env, env | nc …, scp ~/.ssh/id_rsa … | sends secrets over the network |
| fork bombs |
Asks you first
| Command | Why |
|---|---|
| recursive deletes outside the project (and links that resolve outside it); temp dirs are fine | may hit other work |
git push --force / -f / +branch / --delete, git reset --hard, git clean -f, git checkout -- ., git branch -D | rewrites history or throws away work |
git add .env, private keys | stages secrets (.env.example is fine) |
prisma migrate reset, prisma db push --force-reset / --accept-data-loss, rails db:drop, manage.py flush, DROP / TRUNCATE / DELETE FROM in psql/mysql, FLUSHALL | deletes database data |
terraform/tofu destroy, pulumi destroy, cdk destroy, kubectl delete namespace / --all, helm uninstall | tears down infrastructure |
docker compose down -v, docker system prune -a --volumes, docker volume rm | deletes volumes |
aws s3 rm --recursive, aws s3 rb, aws … delete-/terminate-, gcloud … delete, az … delete, platform destroy commands | deletes cloud resources |
Routine commands are not touched: rm -rf node_modules dist inside the project, git push, prisma migrate deploy, docker compose down, terraform plan.
Set it up (Claude Code)
Requires @codexguild/mcp 1.5.0 or newer (@latest below always takes the newest).
Add the hook to ~/.claude/settings.json (or the project's .claude/settings.local.json, which is not committed):
{
"hooks": {
"PreToolUse": [
{ "matcher": "Bash", "hooks": [{ "type": "command", "command": "npx -y @codexguild/mcp@latest guard", "timeout": 20 }] }
]
}
}The command checks need no key. The package checks use CODEXGUILD_API_KEY from the environment Claude Code
starts in — export it in your shell profile; never put the key in a settings file.
Note: A hook is a safety net, not a sandbox. Keep using Claude Code's permission modes, devcontainers and backups for anything that matters.