Block destructive commands before your AI agent runs them.

Don't rely on guidelines to stop a bad command. CC Safety Net hooks into your coding agent and blocks destructive commands and secret file access before they run.

~/repo/pre-exec-hook

$ git reset --hard HEAD

✖ BLOCKED by CC Safety Net

Reason: destroys all uncommitted changes. Use 'git stash' first.

If this operation is truly needed, ask the user for explicit permission and have them run the command manually.

$ cat .env

✖ BLOCKED by CC Safety Net

Reason: reads secrets from an environment file.

$ git checkout -b feature/auth

✔ allowed

Destructive intent gets a hard stop.

These are a few examples of destructive git and filesystem operations CC Safety Net catches before your AI coding agent can run them. Read the docs for the full list of blocked operations and matching behavior.

$ git reset --hard

blocked

Reason: discards every uncommitted change in the current branch.

$ git restore .

blocked

Reason: discards tracked file changes in the working tree.

$ git clean -fd

blocked

Reason: deletes untracked files and directories from the workspace.

$ git push --force

blocked

Reason: overwrites remote branch history without lease protection.

$ rm -rf ~

blocked

Reason: recursively removes the home directory.

$ rm -rf .

blocked

Reason: recursively removes the current project directory.

Your secrets are off-limits. Even for reads.

New in v2: 132 secret-protection rules block reads and writes of credential files — env files, SSH keys, cloud credential stores, and coding agent tokens — before command analysis even starts. Active in every safety level. Read the docs for every protected path and how to tune them.

$ cat .env

blocked

Reason: reads API keys and tokens from an environment file.

$ cp ~/.ssh/id_rsa /tmp/key

blocked

Reason: copies a private SSH key out of your key directory.

$ cat ~/.aws/credentials

blocked

Reason: reads AWS access keys from the credential store.

$ grep token ~/.claude/.credentials.json

blocked

Reason: reads your coding agent's own auth token.

How CC Safety Net works

It sits in the command path for your coding agent, checks the bash command before it runs, and returns a clear denial when the command would destroy local state.

Agent proposes a command

Claude Code, Codex, Cursor, or another supported CLI prepares a shell command for your workspace.

The hook inspects it first

CC Safety Net runs before execution and analyzes the command intent instead of relying on brittle text patterns.

Destructive intent is blocked

Dangerous git and filesystem operations and secret file access are denied, including shell wrapper forms like bash -c.

Make your own custom rules

Tell your coding agent what your team wants blocked. The CC Safety Net skill can inspect your project, draft the rulebook, verify it, and fix errors without making you hand-write JSON.

~/cc-safety-net/custom-rules

$ /cc-safety-net read my package.json and suggest blocking rules

$ /cc-safety-net set up rules to block all terraform destroy commands

$ /cc-safety-net verify my rules and fix any errors

Tune the policy from a local GUI

New in v2: a dashboard for your policy. Review every blocked command, switch safety presets, toggle individual rules, and test a command before your agent runs it — no hand-written JSON.

Six views: Overview, Activity, Policy, Rules, Integrations, and Settings. It binds to 127.0.0.1 with a fresh token per launch — nothing leaves your machine.

$ npx cc-safety-net gui

127.0.0.1:52341/?token=f3a9…

Policy

Unsaved changes

DiscardSave

Safety preset

Standard · Customized

Standard

Recommended for normal coding.

Strict

Also blocks dynamic, unparseable commands.

Paranoid

Maximum protection for untrusted agents.

Destructive command protection

Block destructive git, filesystem, and execution patterns.

Secret protection

Block sensitive paths, CLI credentials, and deny paths.

Test a command

git push --force

Blocked — overwrites remote branch history without lease protection.

Works with every major coding agent

One command installs the safety net into every coding agent it detects. Select your agents, press Enter, and every shell command they propose is checked first.

~/cc-safety-net/install

$ npx -y cc-safety-net@latest install

✔ safety net active

Destructive commands and secret file access are now blocked before they execute.

# already on v1? upgrade every installed integration:

$ npx -y cc-safety-net@latest update