Block destructive commands before your AI agent runs them.

CC Safety Net is a pre-execution hook for AI coding agents like Claude Code, Codex, and Cursor. It reads each shell command and file tool call before it runs, and blocks the ones that destroy work or expose secrets: git reset --hard, git push --force, rm -rf on your home directory, and reads of .env files, SSH keys, and cloud credentials. It supports 16 coding agent CLIs on macOS, Linux, and Windows, and is free and MIT licensed. It is not a sandbox.

Install CC Safety Net with npx -y cc-safety-net@latest install, then run npx -y cc-safety-net@latest doctor to confirm the hook is active. It needs Node.js 18 or later. From then on, git reset --hard, git checkout -- ., git clean -f, git stash clear, and git push --force are denied, and the agent is told why and what safer command to use. rm -rf is blocked on your home directory, the filesystem root, and paths outside the project. Deleting inside the project is allowed unless you turn on the paranoid level.

It depends. Deny rules are deterministic and still apply in bypassPermissions mode, so if you only need to block a few exact commands in one CLI, they may be enough. Their limit is that they match the command string against a wildcard pattern. Reordered flags (rm -r -f), a shell wrapper (sh -c "..."), or an interpreter can slip past. CC Safety Net parses what the command does, so those variants are still caught. It also gives you one policy and one audit log across 16 CLIs instead of a separate format per tool. Many setups use both.

Partly. As of October 2026, Claude Code's auto mode uses a classifier model that blocks git reset --hard, git clean -fd, git stash clear, and similar commands by default. That's a judgment call, and Anthropic publishes a 17% false-negative rate for the classifier on real overeager actions. bypassPermissions mode asks about nothing. A CC Safety Net denial is a deterministic check: tested against Claude Code 2.1.251, it fires in default, auto, and bypassPermissions modes. If you review every command yourself in default mode, you may not need it.

If you care about uncommitted work, probably yes. A sandbox like Claude Code's or Codex's limits writes to the project directory and restricts network access. But git reset --hard and rm -rf . write inside that directory, and git push --force goes to a remote you allowed, so the sandbox permits all three. CC Safety Net blocks them. It does not contain processes or control the network. If your main worry is prompt injection, malicious dependencies, untrusted code, or data leaving over the network, a sandbox is the better choice. Use both.

Not reliably. As of October 2026, Claude Code's checkpointing docs say checkpoints don't track files changed by bash commands. Only edits made through Claude's file editing tools can be rewound. git reset --hard, git clean, and rm all run as bash commands, so the work they discard is outside what a rewind restores. Containers have the same gap: a mounted working tree holds your real uncommitted work, and a push still reaches your real remote. Blocking the command before it runs is the safer layer, with Git commits for long-term history.

No. As of October 2026, Claude Code's sandboxing docs say there is no built-in credential deny list, and its default read access still allows files such as ~/.aws/credentials and ~/.ssh/. Other CLIs offer opt-in deny settings that you write per tool. CC Safety Net blocks reads of .env files, SSH private keys, cloud credential stores, and coding agent auth tokens as soon as it is installed. That covers shell commands like cat .env and the agent's own read, edit, write, and search tools. You can add your own deny paths.

It is free and open source under the MIT license. The hook makes no network requests when it checks a tool call. Decisions are logged on your machine under ~/.cc-safety-net/logs. Only a few commands you run yourself go online. doctor checks the npm registry for a newer version. The GUI fetches the GitHub star count. Rulebook sync downloads rulebooks from GitHub. None of these sends your commands or file contents.

It can, so the levels are adjustable. The default standard level blocks recognized destructive patterns and lets ordinary commands and deletions inside the project run as usual. strict also blocks commands it cannot fully analyze. paranoid adds blocking rm -rf inside the project and python -c or node -e one-liners. Choose a level and turn individual rules on or off in npx cc-safety-net gui or in policy.json. Worktree mode allows local discards like git reset --hard inside a verified linked Git worktree. npx cc-safety-net explain shows why a command was blocked.