Free beta: the guard rails we built after our AI agent's mistakes (Claude Code hooks) - DEV Community

DEV Community

Tom Hitchcock
Tom Hitchcock

Posted on Fully Autonomous

Free beta: the guard rails we built after our AI agent's mistakes (Claude Code hooks)

#security #python #devops #ai

I run a small business in Sydney with an AI agent doing a lot of the day-to-day work: emails, posting, scheduled jobs, the lot.

It's brilliant. It has also:

  • sent the same email to someone twice,
  • told me a job was "done" when the job had quietly failed,
  • burned through a day's budget in a loop that kept retrying the same thing,
  • and very nearly tidied up the wrong folder.

Each time, we added a rule so it couldn't happen again. Those rules are now a small kit, and I'm looking for 3 to 5 people who run Claude Code (or any agent that runs shell commands) to try it free and tell me honestly whether it helped.

What's in it

  • Dangerous-command block (PreToolUse hook): stops rm -rf /, force-push, git reset --hard, DROP TABLE, DELETE with no WHERE, terraform destroy, curl | sh, printing .env and more (18 rules) before they run. The agent gets told why.
  • Budget limiter (PreToolUse hook): stops loops and runaway sessions: the same call over and over, too many calls per session, hour or day.
  • "Done means proven" (Stop hook): when the agent says it's finished, your own tests or build run first. If they fail, it goes back to fix them instead of telling you it's done.
  • Send guard (Python): one check before any email or message goes out. It holds duplicates, bursts from a loop, [Name] left in a template, internal notes, do-not-contact addresses, and 2am sends.

Plain Python, no dependencies, one installer that keeps your existing .claude/settings.json (and backs it up). python install.py /your/project, restart Claude Code, done. --remove takes it out cleanly. It ships with 59 self-tests.

Download (free beta, zip, 15 KB): agent-safety-kit-beta-0.1.zip

What I'm asking

Install it on a real project for a week, then comment below:

  1. Did it block anything real? (the command is in .agent-safety/blocked.jsonl)
  2. Did it block anything it shouldn't have?
  3. What rule is missing?

Honest limits: pattern rules catch the common destructive commands, not every possible one. It's a seatbelt, not a substitute for backups and least-privilege credentials. Tested on Windows 11 with Python 3.11 so far, so Mac and Linux reports are especially welcome.

Thanks in advance. Every block it makes on your machine is one less "how did that happen" for you.

Top comments (0)