azet-guard

Runtime guardrails for AI coding agents. azet-guard plugs into Claude Code hooks and checks every tool call while the agent works:

• Stops catastrophic commands before they run (rm -rf ~, disk wipes, sending .env over the network).
• Keeps secrets out of the model. API keys in a command line are refused, keys in command output are redacted before the agent sees them, and keys pasted into a prompt trigger a "don't repeat this" note.
• Asks before risky moves: curl … | sh, force-pushing main, reading .env or SSH keys, dumping the environment.
• Catches "all tests pass" when no test ran. If the agent is about to finish with that claim and no test command ran in the turn, it is sent back to run them.
• Flags prompt injection in fetched pages and files ("ignore previous instructions…") so the agent treats it as data.
• Logs every decision to an append-only audit log, with secrets redacted.

No dependencies (Python 3.11+ standard library). No network calls. Nothing leaves your machine.

Install

uv tool install git+https://github.com/azet-llc/azet-guard     # or: pipx install git+https://github.com/azet-llc/azet-guard
azet-guard install            # all your Claude Code projects (~/.claude/settings.json)
azet-guard install --project .  # only this repository (.claude/settings.json, commit it to share with your team)

Restart Claude Code (or open /hooks) so the hooks load. azet-guard doctor shows where it is installed and which policy applies; azet-guard uninstall removes only its own entries and keeps your other hooks.

What it does in a real session

These are real Claude Code 2.1.285 runs with azet-guard installed (the key is a fake AWS-format key):

Rules

Detected secret formats: AWS access keys, GitHub tokens, Anthropic and OpenAI keys, Stripe keys, Slack tokens, Google API keys, private key blocks, JWTs.

azet-guard check "<command>" shows what the guard would do with any command (exit 0 allow, 1 ask, 2 deny).

Policy

Defaults work out of the box. Tune them in ~/.azet-guard/policy.toml (you) or .azet-guard.toml in a repository (your team):

mode = "enforce"                 # "monitor" logs what it would do but never blocks — good for a trial week
disable = ["dump_environment"]
require_tests_for_claims = true

[actions]                        # change a built-in rule: deny | ask | warn
pipe_to_shell = "deny"

[[shell_rules]]                  # add your own
action = "ask"
rule = "send_email"
pattern = '\bsendmail\b|\bmail\s+-s\b'
message = "Sends email to someone outside the team."

Audit log

~/.azet-guard/audit.jsonl (mode 600), one JSON line per decision. azet-guard log prints the latest ones. Secrets are redacted before anything is written.

Honest limits

• It is a guardrail, not a sandbox. The rules are regular expressions: a determined agent can obfuscate a command ($(echo cm0= | base64 -d) -rf ~). Use it together with Claude Code permissions and, for untrusted work, a container.
• Secret detection covers formats with a recognisable prefix. Plain passwords and custom tokens are not detected unless you add a rule.
• The test-claim check looks for a test command in the turn; it does not judge whether those tests cover your change.
• If azet-guard itself crashes, it fails open (your session keeps working) and records the error in the audit log. A policy file that doesn't parse fails loudly instead.

Roadmap

Codex CLI and Cursor adapters, a team dashboard with shared policies and audit search, and SSO. If you want the team version early, write to hello@azet.io.

Development

python3 -m unittest discover -s tests -v

License

Apache-2.0. Made by AZET.