CC Safety Net — Safety Net for AI Coding Agents
Intercept and block destructive git and filesystem commands, and secret file access, before AI coding agents execute them.
Evidence shows: tool runs as PreToolUse hook, blocks destructive commands, fail-closed by default, audit logging with secret redaction. Deductions: user confirmation mechanism not explicit (only trust hook), rollback capability not mentioned, publisher identity unverified.
Evidence shows: CI, tests, build scripts, single dependency (shell-quote), error messages tested. Deductions: actual execution not verified, dependency availability not fully confirmed.
Evidence shows: multi-platform, multi-agent support, mode configuration, trigger precision via semantic analysis. Deductions: environment fit details not fully verified.
Evidence shows: README, install instructions, docs links, MIT license, version number, changelog generation script. Deductions: maintenance responsibility not explicit, publisher unverified.
Evidence shows: doctor and explain commands, usable output, high marginal value (prevents data loss). Deductions: cost-benefit not quantified.
Evidence shows: README claims align with code tests, test coverage. Deductions: cross-source corroboration insufficient, only single repository.
- Publisher identity unverified, exercise caution.
- User confirmation mechanism unclear, may affect security.
- Rollback capability not mentioned, data loss risk noted.
What does this agent do, and when should you use it?
CC Safety Net is a PreToolUse hook that stops AI coding agents from running dangerous commands like `rm -rf`, `git reset --hard`, or `git push --force`. It parses command semantics rather than matching strings, so flag reordering, shell wrappers, or interpreter one-liners can't bypass it. It supports Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Kimi Code, OpenCode, and Pi, across Windows, macOS, and Linux. It opens fail-closed by default, blocking commands even on malformed input or invalid config. It offers audit logging, custom rules via rulebooks, and opt-in modes like Strict and Paranoid. Installation varies by agent, including plugin marketplaces or `npx`, and diagnostics are available via `npx cc-safety-net doctor`.
Operates as a pre-tool-use hook that intercepts Bash calls. It analyzes command semantics: distinguishing git checkout -b feature (safe) from git checkout -- file (destructive). It recursively analyzes shell wrappers like bash -c and sh -c up to 10 levels, and detects destructive code in interpreter one-liners (python -c, node -e, etc.). It blocks commands by default and logs to ~/.cc-safety-net/logs/<session_id>.jsonl. It supports modes via environment variables like CC_SAFETY_NET_STRICT=1, CC_SAFETY_NET_PARANOID=1, and CC_SAFETY_NET_WORKTREE=1. It provides CLI commands npx cc-safety-net doctor and npx cc-safety-net explain.
- A developer using Claude Code on their own machine wants to prevent the agent from accidentally running
rm -rf ~/orgit checkout --, which could wipe hours of uncommitted work. - A team using Codex wants to enforce safety policies so that destructive commands are blocked even if the agent tries to bypass simple command blocking with wrappers or flag reordering.
- A developer using Kimi Code or OpenCode wants consistent protection across multiple CLI agents with a single tool.
- A developer using AI coding agents on Windows needs path comparison and command resolution to correctly handle
\andcmd.exe. - A developer who wants extra safety by enabling Strict mode to block unparseable commands and Paranoid mode to block more aggressively, even while actively using the agent.
What are this agent's strengths and limitations?
- Semantic analysis understands command intent, not just strings, distinguishing safe vs dangerous
git checkoutandrmusage. - Works across multiple agent CLIs (Claude Code, Codex, Gemini CLI, etc.) and platforms (Windows, macOS, Linux).
- Fail-closed default, Strict, Paranoid, and Worktree modes, custom rulebooks, and audit logging provide fine-grained control.
- Diagnostics via
npx cc-safety-net explainanddoctorhelp understand and verify security behavior.
- Only works as a PreToolUse hook, so it requires agents that support such hooks (not all AI tools).
- Installation is agent-specific and can be complex (e.g., Codex requires TUI steps, OpenCode has cache issues).
- Requires Node.js 18+ and introduces an additional runtime dependency.
- Legacy custom rules are not auto-migrated; manual migration needed, otherwise commands stay blocked (fail-closed).
- Relies on network to fetch rulebooks if referenced from GitHub; each agent requires separate installation.
How do you install or deploy this agent?
Requires Node.js 18 or higher. Installation differs per agent:
- Codex: Enable plugin hooks in ~/.codex/config.toml ([features] plugin_hooks = true), then codex plugin marketplace add kenryu42/cc-marketplace, then install via TUI /plugins and trust via /hooks.
- Claude Code: /plugin marketplace add kenryu42/cc-marketplace, then /plugin install safety-net@cc-marketplace, then /reload-plugins.
- Gemini CLI: gemini extensions install https://github.com/kenryu42/gemini-safety-net.
- GitHub Copilot CLI: /plugin install kenryu42/copilot-safety-net.
- Kimi Code: npx -y cc-safety-net hook install --kimi-code, optionally npx skill add kenryu42/cc-safety-net.
- OpenCode: opencode plugin -g cc-safety-net.
- Pi: pi install npm:cc-safety-net.
How do you use this agent?
After installation, the hook automatically intercepts Bash calls. Use your AI agent normally; destructive commands will be blocked. Verify with npx cc-safety-net doctor and trace commands with npx cc-safety-net explain "git reset --hard". Optionally set environment variables like CC_SAFETY_NET_STRICT=1 for strict mode. If you have legacy custom rules, migrate them with npx -y cc-safety-net rule migrate.
How does this agent compare with similar options?
Compared to sandboxing, sandboxes allow destructive commands within the project directory, while CC Safety Net actively blocks them; they can be used together for defense-in-depth.
FAQ
Does it cost money?
How can I allow a destructive command?
What commands are blocked?
rm -rf, git reset --hard, git push --force, git stash clear, git clean -f, find -delete, dd, mkfs, shred, etc., even if wrapped in shell wrappers or interpreter one-liners.