Skip to main content
CC Safety Net is a best-effort, static pre-execution hook for supported coding-agent tool calls. It stops recognized destructive commands and secret reads before they run. It is not an operating-system sandbox, a privilege boundary, or protection for commands that bypass an installed integration.

​
What CC Safety Net protects

CC Safety Net treats every command an agent generates as untrusted. Prompt injection, confused context, or adversarial instructions can make an agent emit a destructive command, so the hook checks each supported tool call before the host runs it and denies the call when it finds a block reason. How much of a call gets checked depends on the tool:
  • An integration’s own shell tools get full command analysis at your safety level.
  • A tool you declare in command_tools is analyzed like a built-in shell tool when the call carries a non-empty string command.
  • Every other tool gets policy-file, Git-metadata, and sensitive-path checks only. CC Safety Net never treats its text as a shell command.
  • A command that does not go through an installed integration is never checked.
The safety level sets how much analysis catches. Which safety level should I use? compares the levels.
Standard mode is not adversarial-grade. Standard allows dynamic rm -rf targets such as rm -rf "$target"; strict and paranoid block them. Use strict or paranoid when commands may come from prompt injection or another adversarial context.
No level or policy setting turns off the catastrophic rules, which cover recursive deletion of / or your home directory, and the protections for Git metadata and policy.json. While secret protection is on, no level relaxes reading a recognized secret file’s contents or a path you listed in deny_paths.

​
What CC Safety Net trusts

Three inputs from outside the hook can change what it enforces. CC Safety Net validates each one before it takes effect. An invalid configuration never denies ordinary work on its own. CC Safety Net drops the rejected source and reports the runtime as degraded. Dropping a rulebook removes its denials, so a command it blocked can run again until you fix it. Configuration recovery lists every failure and its fallback.

​
What happens when analysis fails

When analysis of one tool call cannot finish, CC Safety Net denies that call instead of letting it run:
  • An unexpected analyzer error produces a deny with a “failed closed” reason.
  • CC Safety Net denies malformed hook input, and any command too large or too deeply nested to analyze, at every safety level, standard included. A command that hits an analysis budget gets a reason that tells the agent to simplify or split it.
  • Strict and paranoid also deny a command the parser cannot read. Standard lets safe-looking unparseable text through and still scans it for destructive patterns.
This depends on the host honoring the deny. Grok Build, Factory Droid, and Devin CLI fail open by design, so a hook that crashes, times out, or prints nothing lets the call run. Known limitations lists each host’s behavior.

​
What redaction hides and what it keeps

Before CC Safety Net writes command text to the audit log or returns it in a denial message, it replaces recognized credentials with <redacted>. The list covers private keys, URL credentials, secret-bearing environment assignments and HTTP headers, presigned-URL signatures, JWTs, AWS access key IDs, and known token prefixes. The audit log reference gives the full list. Redaction matches known credential shapes only. It keeps absolute paths, project and directory names, hostnames, IP addresses, usernames, and any credential in an unlisted format. Avoid passing real credentials through commands an agent runs. explain and doctor output carries the same raw text, so read it before you share it. See Before you share a trace.

​
How an attacker could try to get past it

Network attacks, attacks on the agent platform itself, and a symlink swapped between the check and the run are outside what a pre-execution hook can stop. See Out-of-scope protections.
Last modified on October 22, 2026