Practical overview
When it fits
Use it when an AI coding CLI needs a pre-execution check for destructive Git or filesystem commands and common sensitive-file access attempts.
Who it is for
- Developers using supported AI coding CLIs who want a pre-execution check for destructive commands.
- Teams seeking to block common attempts by coding agents to access SSH keys, `.env` files, and other secrets.
Documented uses
- Intercept risky shell and filesystem actions before an agent's tool call runs.
- Allow ordinary calls such as `git status` while blocking documented dangerous operations such as `git reset --hard`.
- Add a focused command guard to supported coding-agent workflows.
Requirements & limits
The quick start requires Node.js 18 or higher and installs into coding CLIs on the current machine. The repository displays an MIT license.
- The README lists support for Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, Factory Droid, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and
- The project states support for Windows, macOS, and Linux; per-CLI requirements are documented separately.
- The guard parses what commands do, so wrapping a command or reordering flags does not hide it.
- A broken configuration file never blocks anything.
- It does not contain processes, set filesystem permissions, or monitor network egress.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Install CC Safety Net integrations and check protection
Install CC Safety Net into detected coding CLIs and run its diagnostic check.
Before you start
- Node.js 18 or later.
- At least one supported coding CLI detected on the machine; the installer supports interactive selection.
Steps
Run the command below to open the multi-select installer.
npx -y cc-safety-net@latest installIn the selector, press Space to select a target and Enter to confirm. Press q or Esc to cancel without changes.
Run the command below to check that protection is working.
npx -y cc-safety-net@latest doctor
Expected outcome
Selected integrations are installed, and the doctor command checks protection readiness.
Guide limitations
- CC Safety Net is a pre-execution guard, not a sandbox: it does not contain processes, set filesystem permissions, or monitor network egress.
- A broken configuration file never blocks anything.
- Hermes Agent and OpenClaw integrations are limited to macOS and Linux.
Compare options for AI coding assistance
These projects document a common task and share a project role. This is a source-based comparison, not an execution benchmark or a guarantee of interchangeability.
| Project | Documented purpose | Platform | Access and requirements |
|---|---|---|---|
| Cc Safety Net | Intercept risky shell and filesystem actions before an agent's tool call runs. | CLI | The quick start requires Node.js 18 or higher and installs into coding CLIs on the current machine. The repository displays an MIT license. |
| Destructive Command Guard | Intercept an agent's shell or Git command before it runs. | CLI | The project documents prebuilt-binary installation through shell and PowerShell installers, Homebrew, and manual release archives. The shell installer is described for Linux, macOS and Windows via WSL; a separate installer is provided for native Windows. |
| Agent Safehouse | Run a coding agent with access limited to files and integrations it needs. | CLI, macOS, Self-hosted | The project documents installation through Homebrew or a standalone shell script. It is open source under the Apache-2.0 license. |
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 13 October 2026
- Original website title
- kenryu42/cc-safety-net · Official homepage title · retained in its source language