cc-safety-net

Overview of cc-safety-net

What it is

CC Safety Net (Coding CLI Safety Net) is a pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. It parses what the command does, so wrapping the command or reordering flags does not hide it. A broken config file never blocks anything. It is not a sandbox: it does not contain processes, set filesystem permissions, or watch network egress.

Key features

• Blocks destructive commands such as git reset --hard, git push --force, and rm -rf on dangerous targets, even inside bash -c or python -c.
• Blocks secret access to SSH keys, .env files, ~/.aws, and coding-CLI credentials, from the shell and from the agent's file tools.
• Tunes the policy in a GUI: run npx cc-safety-net gui to pick the Standard, Strict, or Paranoid preset and turn rules on or off.
• Adds blocks through rulebooks: official packs for Terraform, AWS, gcloud, and Azure, or your own JSON.
• Shares policy through git: commit .cc-safety-net/ so clones and cloud sessions get the same rules.
• Embeds in your own tools: call checkCommand from Node.js without installing the hook.

Use cases

• Protecting local development environments from accidental destructive actions by AI coding agents.
• Preventing exposure of secrets (SSH keys, .env files, cloud credentials) during agent-driven sessions.
• Enforcing consistent safety policies across team clones and cloud sessions via git-shared rulebooks.
• Integrating safety checks into custom Node.js tools that invoke commands.

Getting started

You need Node.js 18 or higher. Install into the coding CLIs on this machine, then check that protection is working: bash npx -y cc-safety-net@latest install npx -y cc-safety-net@latest doctor Update with npx -y cc-safety-net@latest update and uninstall with npx -y cc-safety-net uninstall. Keep the @latest qualifier: a bare cc-safety-net spec can run an older copy from the npx cache.

License and pricing

License: MIT. Pricing: open source (no pricing information provided).

Based on the project's public README and repository metadata.