What is CC Safety Net?
CC Safety Net is a pre-execution hook for AI coding agents like Claude Code, Codex, and Cursor. It checks each command and file operation before it runs and blocks the ones that destroy uncommitted work or expose secrets, such asgit reset --hard, git push --force, rm -rf on your home directory, and reads of .env files, SSH keys, and cloud credentials. It supports 16 coding agents.
Why it exists
As of October 2026, no major coding CLI deterministically blocks destructive git commands inside the workspace you handed it.git reset --hard, git checkout -- ., git clean -f, git stash clear, and git push --force act on files the agent may already write, so a sandbox that scopes writes to the project sees nothing wrong. OpenAI’s Codex security docs say commands under workspace-write “can still mutate state and perform destructive operations”. Claude Code’s sandboxing docs scope writes to the working directory, which is where your uncommitted work lives.
Three more reasons to run it:
- A deterministic check under probabilistic ones. As of October 2026, Anthropic publishes a 17% false-negative rate for the Claude Code auto-mode classifier on real overeager actions and calls it “not a drop-in replacement for careful human review”. A hook applies fixed rules instead of a judgment call.
- Secret protection with nothing to configure. Claude Code has no built-in credential deny list, and other CLIs make you write one per tool. CC Safety Net blocks
.envfiles, SSH keys, and cloud credentials as soon as you install it. See Secret protection. - One policy and one audit trail across 16 CLIs. Five vendors ship five incompatible permission mechanisms and no decision log you can read afterwards.
CLAUDE.md or AGENTS.md guide an agent but cannot enforce a limit. An agent once wiped hours of work with one rm -rf ~/ despite them. Adversa’s incident tracker records nine agent destruction cases from 2025 and 2026, with guardrails enabled in about half. The protection-layers comparison covers the sandbox and allowlist CVEs.
What it intercepts
CC Safety Net installs into your coding agent. It runs before the agent’s tool call reaches your machine. It inspects shell commands and file write, edit, search, and patch operations. It then allows the operation or blocks it with a direct reason. A block arrives as a normal tool result, so the agent can continue the task without the blocked operation. CC Safety Net decides by what a command does, not how it is spelled. It allowsgit checkout -b feature because the command creates a branch. It blocks git checkout -- file because the command discards uncommitted changes. Both commands start with the same two words.
Frequently asked questions
Is CC Safety Net free?
Yes. CC Safety Net is free and MIT licensed. The source is on GitHub.Does CC Safety Net use an LLM?
No. A local, rule-based parser makes every decision, and no model is called. The same command gets the same decision every time. See How it works.Does CC Safety Net send my data anywhere?
No. CC Safety Net has no telemetry and makes its decisions locally, with no network calls. It uses the network only whennpx or bunx fetches the package, when rule add or rule update fetches a rulebook from GitHub, and when update checks the npm registry. The audit log stays on your machine.
Does CC Safety Net slow down my agent?
Integrations that load as a plugin inside the agent add little. Hooks that run throughnpx add a few hundred milliseconds per tool call. If yours are slower, see Troubleshooting.