No description
- Go 99.7%
- Shell 0.2%
- Makefile 0.1%
Kai Siren
7624dc05da
Some checks are pending
ci / test (push) Waiting to run
ci / lint (push) Waiting to run
ci / govulncheck (push) Waiting to run
ci / docs (push) Waiting to run
codeql / analyze (go) (push) Waiting to run
pages / deploy (push) Blocked by required conditions
pages / build (push) Waiting to run
|
||
|---|---|---|
| .agent-guard | ||
| .github | ||
| audit | ||
| config | ||
| decision | ||
| dispatch | ||
| docs | ||
| egress | ||
| examples | ||
| exitcode | ||
| ghcache | ||
| ghidcache | ||
| ghratelimit | ||
| gittree | ||
| hook | ||
| lockdown | ||
| mcporter | ||
| passthrough | ||
| policy | ||
| profile | ||
| profiles | ||
| repocfg | ||
| respfmt | ||
| scope | ||
| scripts | ||
| shell | ||
| skillgen | ||
| ssh | ||
| stscache | ||
| sudo | ||
| ttlcache | ||
| verb | ||
| workdir | ||
| .gitignore | ||
| .golangci.yaml | ||
| .pre-commit-config.yaml | ||
| AGENTS.md | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| go.mod | ||
| go.sum | ||
| godoc-current.txt | ||
| LICENSE | ||
| Makefile | ||
| mkdocs-requirements.txt | ||
| mkdocs.yml | ||
| README.md | ||
| SECURITY.md | ||
| staticcheck.conf | ||
cli-guard
cli-guard is a security-boundary framework for urfave/cli v3 applications, designed to sit between AI agents (or any semi-trusted automation) and the host system, featuring:
- argv validation rejecting shell metacharacters before they reach
execve - append-only JSONL audit log with lumberjack rotation
- read / write / delete scope tokens, validated per verb
--commit-scoperesolution binding every audit row to a git toplevel- clean+synced gate refusing repo-shaped verbs on a dirty tree
- per-repo command allowlist loaded from per-repo YAML config files (e.g.
.agent-guard/agent-guard.yaml,.coily/coily.yaml) - thin pass-through wrapper for embedding existing CLIs as audited subcommands
- per-invocation CONNECT proxy with consumer-supplied egress allowlist
- public exit-code taxonomy for orchestrators
- reusable dispatch subsystem firing
claudeagainst a real open issue, headless or interactive
Documentation
See docs/FEATURES.md for a feature inventory, examples/ for runnable demos one per primitive, and the CLI reference for the rendered command tree of every example. Local dev verbs live in .agent-guard/agent-guard.yaml; agent-guard lint validates that against the Makefile.
Support
If you found a bug or have a feature request, create a new issue. Participation in this community is governed by the Code of Conduct. Security disclosures go through SECURITY.md.
Sibling repos in the cli-* family: cli-mcp, cli-web-docs, cli-web-ops.
License
See LICENSE.
See also
- AGENTS.md - agent-facing operating rules.
- docs/FEATURES.md - inventory of what ships today.
- .agent-guard/agent-guard.yaml - allowlisted commands.
Cross-reference convention from coilysiren/agentic-os#59.