aiguard

Portable Security Harness for CLI Coding Agents

Every CLI coding agent runs commands and edits files directly on your machine, and each one has its own permission model, so protections don't carry over between tools. aiguard is one portable answer: an open-source Rust harness (an 11-crate workspace, dual-licensed Apache-2.0/MIT) that sits between the agent and your system, intercepting every tool call and passing it through layered checks before anything touches your machine — across 8 agents, including Claude Code, Codex CLI, Gemini CLI, Aider, and Goose.

Challenge

CLI coding agents run shell commands, edit files, and call MCP tools directly on the developer's machine. That surface is exposed to prompt injection hidden in the content agents read, secrets leaking into transcripts, and MCP tools silently changing behaviour after they've been trusted. Each agent has its own permission model, so protections don't carry over from one tool to the next.

Approach

Put a single, agent-agnostic harness between the agent and the local system. Every tool call is intercepted and passed through layered checks: prompt-injection detection with 80+ rules including zero-width Unicode and base64 payload checks, secret redaction using 52 gitleaks-compatible patterns with entropy gating, MCP tool pinning via SHA-256 pins that raise rug-pull alerts when a pinned tool changes, and shell/path deny rules. Everything is written to a tamper-evident audit log backed by SQLite and JSONL, and sessions can be reviewed after the fact in a session-replay TUI.

Outcome

One portable harness that works across 8 CLI coding agents instead of eight separate configurations. Developers get injection screening, secret redaction, tool pinning, and deny rules as a single layer, with a tamper-evident audit trail and session replay for reviewing exactly what an agent did. Published as open source under a dual Apache-2.0/MIT license.

Key Features

• Prompt-injection detection — 80+ rules, with zero-width Unicode and base64 payload checks
• Secret redaction — 52 gitleaks-compatible patterns with entropy gating
• MCP tool pinning — SHA-256 pins with rug-pull alerts
• Shell and path deny rules
• Tamper-evident audit logging (SQLite + JSONL)
• Session-replay TUI
• Supports 8 agents, including Claude Code, Codex CLI, Gemini CLI, Aider, and Goose
• Rust workspace of 11 crates

Stack & Methods

• Rust — 11-crate workspace
• Layered tool-call interception
• SHA-256 tool pinning for MCP servers
• Entropy-gated, gitleaks-compatible secret patterns
• SQLite + JSONL tamper-evident audit log
• Terminal UI for session replay
• Dual Apache-2.0/MIT license