Failproof AI
A local policy layer that intercepts risky coding-agent actions before they become incidents.
- Source repo
- FailproofAI/failproofai
- Stars
- ★ 8.1k
- Last updated
- 3d ago
- License
- NOASSERTION
- Primary language
- TypeScript
- FA score
- 40/100 · Major gaps
At a glance
- How it runs
- Works with
- Portable with changesCodex · Claude Code
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A developer using Claude Code or Codex on a production repository who wants direct pushes to main/master stopped before execution.
- Not a fit if
- Teams needing hosted fleet observability without an Enterprise plan
- Teams whose agents run outside the twelve supported harnesses
- Environments without npm, shell, or local filesystem access
- Source review
- 40/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
Failproof AI is a local runtime policy tool for coding-agent CLIs that operates through hooks around agent tool calls. The repository explicitly lists support for Claude Code, OpenAI Codex, GitHub Copilot CLI, Cursor Agent CLI, OpenCode, Pi, and other named CLIs. Its installation flow activates 30 built-in policies and exposes a local dashboard at localhost:8020. Documented protections include direct pushes to main/master, force pushes, commits or history operations on the primary branch, recursive deletion, and API-key exposure in agent context. Teams can add JavaScript policies under .failproofai/policies/ and commit them for teammates to load after pulling.
After failproofai runs, it hooks into supported agent CLIs and evaluates their tool calls. Built-in policies inspect actions such as git push --force, direct pushes to main/master, commits/merges/rebases on main/master, recursive file deletion, and API keys entering agent context; policies return allow(), deny(message), or instruct(message). Custom JavaScript policies are registered with customPolicies.add(), can match events such as PreToolUse, and can inspect tool input through ctx.toolInput, including file_path. Each agent tool call is logged locally, and the dashboard shows what ran, what was blocked, and the policy message returned to the agent.
- A developer using Claude Code or Codex on a production repository who wants direct pushes to main/master stopped before execution.
- An engineering team that permits agent-driven Git workflows but needs to block
git push --forceand primary-branch commits, merges, or rebases. - A maintainer assigning cleanup work to a coding agent who wants recursive deletion intercepted by policy.
- A security-conscious team that wants
sanitize-api-keysto prevent API keys from leaking into agent context. - A repository owner who wants to block writes to production paths with a committed
no-production-writespolicy.
How do you install or deploy this agent?
No credentials are documented. Install globally with npm and install the policies:
npm install -g failproofai
failproofai policies --installThen start it:
failproofaiThe first run presents a prompt; set FAILPROOFAI_NO_FIRST_RUN=1 to disable it.
How do you use this agent?
Run failproofai after installation; the README states that 30 built-in policies activate immediately. Open localhost:8020 to inspect local session and policy activity. For repository-specific controls, add a JavaScript file under .failproofai/policies/ and register it with customPolicies.add({ name, match: { events: ["PreToolUse"] }, fn }); have fn return allow(), deny(message), or instruct(message). Commit the policy so teammates can load it on their next pull.
What are this agent's strengths and limitations?
- Applies policy at the agent tool-call boundary, allowing it to block risky Git actions and recursive deletion before they execute.
- Ships with 30 built-in policies, with explicitly documented coverage for primary-branch safety, force pushes, and API-key context exposure.
- Supports repository-level JavaScript policies that autoload from
.failproofai/policies/. - Keeps a local tool-call record and provides a localhost dashboard for executions, blocks, and policy feedback.
- The documented integrations are named agent CLIs; the supplied material does not describe a generic protocol or integration path for arbitrary agent runtimes.
- Adoption requires shell usage, npm, and local filesystem access rather than a hosted service workflow.
- Commercial resale of Failproof AI itself requires a separate agreement under its MIT plus Commons Clause licensing.
- The supplied material links to, but does not detail, the full built-in-policy behavior, false-positive handling, or performance measurements.
How does this agent compare with similar options?
Failproof AI is not presented as a replacement for Claude Code or Codex; it adds a hook-based runtime policy layer to those coding agents and other listed CLIs, including GitHub Copilot CLI, Cursor Agent CLI, OpenCode, Pi, Hermes, OpenClaw, Factory Droid, Devin CLI, Antigravity CLI, and Goose.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Failproof AI This agent | 40 · Major gaps | CLIFreemium | ★ 8.1k | 3d ago | TypeScript | Codex · Claude Code |
| Octogent | 59 · Major gaps | CLIFree + model costs | ★ 1.4k | 6mo ago | TypeScript | Claude Code |
| OrchestKit AI Development Toolkit | 86 · Good | Agent plugin / skillFree + model costs | ★ 299 | today | TypeScript | Claude Code |
| CC Safety Net — Safety Net for AI Coding Agents | 63 · Some gaps | CLIFree | ★ 1.9k | 1d ago | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows policy mechanisms (deny/allow) and local running, but least privilege is not explicit; user confirmation only mentioned for first-run prompt, not all dangerous operations; data flow transparency has local logs and dashboard but no data flow details; sensitive data handling has sanitize-api-keys policy but no storage/encryption details; dependency security has OSV-Scanner and Socket but no scan results; external effects include blocking dangerous git operations but no network access details; rollback mechanism not mentioned; source attribution has author info but publisher unverified.
Self-consistency: README claims zero latency but no performance data; dependency availability: CI and build processes exist but no availability guarantees; failure messages: deny messages returned to agent but no error handling details.
Audience and scenarios: targets developers and multiple agent CLIs, scenarios clear; capability boundaries: 30 built-in policies but no limits on custom policies; trigger precision: event matching exists but no false positive rate; environment fit: supports multiple CLIs and local running but no system requirements.
Information architecture: docs links and table of contents, clear structure; install notes: npm install command but no detailed steps; naming stability: beta version may be unstable; examples and FAQ: custom policy example but no FAQ; known limitations: not explicitly listed; license: MIT+Commons Clause but metadata NOASSERTION; versioning and changelog: version number but no changelog; maintenance responsibility: authors and contact but no maintenance plan.
Output usability: dashboard and logs but no output format; marginal value: failure prevention feature, unique value; cost benefit: local running but no performance data.
Claim traceability: README has docs links but no specific evidence; cross-source corroboration: CI and scanning exist but no results; fact-inference separation: not explicitly distinguished.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Publisher unverified, identity unknown.
- License metadata NOASSERTION, actual MIT+Commons Clause, confirm compliance.
- Beta version may be unstable.
- No rollback mechanism provided.
- No performance data, zero latency claim unverified.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v1.0.13 FailproofAI v1.0.13
Release notes excerpt
failproofai 1.0.13 This release restores policy enforcement on OpenClaw 2026.9.6+ and on Antigravity's current file tools, and makes daemon setup work on Fedora, RHEL, Rocky and Alma. Fixes Antigravity - Path policies enforce again. Antigravity's read_file, write_file and edit_file tools were not recognized, so path-based policies and the guard protecting failproofai's own config saw no path and allowed the call. An agent could read and overwrite .env, create id_rsa, and overwrite .failproofai/policies-config.json. These calls are now denied. (#961) …View on GitHub ↗ -
fp-cloud-cli-v0.0.2 fp-cloud-cli 0.0.2
Release notes excerpt
fp-cloud-cli 0.0.2 is on PyPI: https://pypi.org/project/fp-cloud-cli/0.0.2/ --- Stable release. The 0.0.2b0 line the bump job opened after 0.0.1 is cut stable here rather than published, because the server endpoints these commands drive are now deployed to FailproofAI Cloud and the CLI should not trail them as a pre-release. Nothing about the command surface changes at the cut: the entries below are the entire diff from 0.0.1, and the bump job opens 0.0.3b0 after the upload. Added …View on GitHub ↗ -
v1.0.12 FailproofAI 1.0.12
FAQ
Does it replace my coding agent?
What decisions can a policy make?
allow() permits the operation, deny(message) blocks it and sends a message back to the agent, and instruct(message) permits it while adding context to the agent's next prompt.Are logs required to leave my machine?
localhost:8020; it does not state that log upload is required.How can a team share custom controls?
.failproofai/policies/ and commit them. The README states that teammates receive them on their next pull.