Skip to main content
Install CC Safety Net, confirm it is active, and watch it block a harmless command. The steps are the same for every supported agent.
1

Install CC Safety Net for your agent

Each agent uses a plugin marketplace, extension, configuration file, or package install. Run the install command for your agent from Install for one agent, then return here.
2

Check the status

Get a one-screen summary of which protections are active:
The verdict line reads ready when your configuration loaded cleanly. degraded means CC Safety Net could not apply part of your configuration and is using a fallback. See Configuration recovery to repair it. For everything status prints, see the status command reference.
3

Run doctor

status summarizes your configuration. doctor tests each agent’s integration end to end:
It checks every supported agent at once, so you do not have to tell it which one you use. It also runs a self-test that confirms blocking works. A clean run prints a green checkmark next to each item. For each item that fails, doctor explains what went wrong and how to fix it. The full check list is in the doctor command reference.
4

See a real block

With CC Safety Net active, ask your agent to run this harmless probe:
The command never reaches your shell. Your agent gets a block message instead. If protection is inactive, the exclusion-only Git pathspec selects no files, so Git changes no tracked file.The message explains the block and gives the agent a safer next action. For the message structure and the rest of the decision lifecycle, see How it works.
5

Ask why, without running anything

If a decision surprises you, explain evaluates a command string through the same engine without executing it:
It prints the verdict, the rule that matched, and the effective configuration.
The output can contain your paths, hostnames, and project names. Read Before you share a trace before you paste it anywhere.

​
Next steps

How it works

Follow one tool call through interception, ordered checks, the allow or block, and the audit record.

Blocked commands

Browse what CC Safety Net blocks by default and the reasoning behind each entry.

Modes

Compare the standard, strict, and paranoid safety levels and worktree mode.

Custom rules

Define your own blocking rules at the project or user level to enforce project conventions.
Last modified on October 22, 2026