# CC Safety Net > Documentation for CC Safety Net, a PreToolUse hook that uses semantic analysis to block destructive Git and filesystem commands and secret-file access before AI coding agents run them. ## Docs - [Guardrails for coding agents](https://ccsafetynet.com/docs/index.md): CC Safety Net blocks destructive git and filesystem commands and secret file access before coding agents can execute them. Protect your work and your credentials across Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Hermes Agent, Kimi Code, OpenClaw, OpenCode,… - [What CC Safety Net does](https://ccsafetynet.com/docs/introduction.md): CC Safety Net is a pre-execution guard that inspects what your coding agent is about to run and blocks the operations that destroy uncommitted work or expose your secrets. - [Install CC Safety Net for your coding agent](https://ccsafetynet.com/docs/installation.md): Install and uninstall CC Safety Net across all twelve supported coding agents: Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi. - [Get started with CC Safety Net](https://ccsafetynet.com/docs/quickstart.md): Install CC Safety Net, check its status, run doctor, and watch it block a real command. The same first-run path works for every supported coding agent. - [How CC Safety Net intercepts and blocks destructive commands](https://ccsafetynet.com/docs/guides/how-it-works.md): The lifecycle of a single tool call: agent request, integration interception, ordered protection and analysis, the allow or block response, the audit record, and where to look when a decision surprises you. - [The local dashboard](https://ccsafetynet.com/docs/guides/dashboard.md): Launch the local CC Safety Net dashboard with cc-safety-net gui and use its six views — Overview, Activity, Policy, Rules, Integrations, and Settings — to inspect decisions, edit policy, and manage agent hooks. - [Safety levels and worktree mode](https://ccsafetynet.com/docs/configuration/modes.md): What CC Safety Net's standard, strict, and paranoid safety levels block, plus worktree mode. Set a level in policy.json or with environment variables to tune behavior for your workflow. - [Policy file: the complete policy.json contract](https://ccsafetynet.com/docs/configuration/policy.md): Full reference for CC Safety Net's policy.json: location, schema, safety presets and capability overrides, worktree mode, destructive-command and secret protection, deny- and allow-path rules, audit retention, defaults, and precedence. - [Environment variables](https://ccsafetynet.com/docs/configuration/environment.md): Complete reference for every CC Safety Net environment variable: safety level, capability toggles, audit scope, debug output, config-directory override, update-check opt-out, and the policy-versus-environment precedence rules. - [Custom rules: extra command argument patterns](https://ccsafetynet.com/docs/configuration/custom-rules.md): Define project and user-level custom blocking rules in CC Safety Net using JSON config files. Block commands by matching command, subcommand, and literal argument patterns with a custom reason message. - [Status line: real-time mode indicators](https://ccsafetynet.com/docs/configuration/status-line.md): Display CC Safety Net's effective safety level, worktree relaxations, and degraded-config warning in Claude Code's status line using bunx, npx, or claude x. - [Configuration recovery: ready and degraded state](https://ccsafetynet.com/docs/configuration/recovery.md): How CC Safety Net behaves when configuration cannot be verified: ready versus degraded state, what stays enforced, how the state is reported, and the exact commands that repair it. - [Blocked commands and why they block](https://ccsafetynet.com/docs/reference/blocked-commands.md): Complete reference of the git, rm, find, device, PowerShell, and sensitive-path commands CC Safety Net blocks, with the safety level each rule needs. - [Allowed commands and why they pass](https://ccsafetynet.com/docs/reference/allowed-commands.md): Git, filesystem, device, PowerShell, and sensitive-path commands CC Safety Net allows through, and which of those allowances strict and paranoid remove. - [Secret protection reference](https://ccsafetynet.com/docs/reference/secret-protection.md): Complete catalog of CC Safety Net's built-in secret-protection rules: sensitive basenames, protected home directories, key-file variants, credential extensions, the two coding CLI tiers, deny and allow paths, and every exemption. - [Audit log reference](https://ccsafetynet.com/docs/reference/audit-log.md): Reference for CC Safety Net's audit log: file layout, JSONL record schema, what is recorded, retention and pruning, and the bounded scope of secret redaction. - [CLI commands reference](https://ccsafetynet.com/docs/reference/cli-commands.md): Reference for every CC Safety Net CLI command: status, doctor, logs, explain, rule, install, update, uninstall, hook, gui, and statusline, with their options and exit behavior. - [Explain JSON trace reference](https://ccsafetynet.com/docs/reference/explain-trace.md): Schema for the JSON returned by cc-safety-net explain --json: ExplainResult fields, the TraceStep variants that describe each analysis step, and what a trace reveals before you share it. - [Glossary](https://ccsafetynet.com/docs/reference/glossary.md): Definitions for CC Safety Net terms: policy, preset, capability, degraded, decision, rulebook, transparent wrapper, integration model, fail-closed, and segments. - [Architecture](https://ccsafetynet.com/docs/guides/architecture.md): The maintainer-level system map: integration adapters, the policy snapshot, the ordered guard stages from tool input to allow or deny, the internal parsers, and the runtime dependency surface. - [How the analysis engine works](https://ccsafetynet.com/docs/guides/analysis-engine.md): Inside the analysis engine: safety-level boundaries, wrapper and interpreter recursion, shell function calls, git rules, recursive-delete target classification, device commands, and custom rule matching. - [Design principles](https://ccsafetynet.com/docs/guides/design-principles.md): The reasoning behind CC Safety Net: semantic analysis over wildcards, a fixed guard order with always-on protections, fail-closed on the tool's own failure, denials that keep the agent on task, a minimal dependency surface, rulebooks, defense-in-depth, and worktree relaxation. - [Security model](https://ccsafetynet.com/docs/guides/security-model.md): How CC Safety Net models trust: the AI-to-shell boundary, what each safety level guarantees, the configuration recovery boundary, and the disclosure classification. - [CC Safety Net vs. OS-level sandboxing](https://ccsafetynet.com/docs/guides/vs-sandboxing.md): Compare CC Safety Net with OS-level sandboxing. They defend against different threats and provide stronger defense-in-depth when used together. - [How CC Safety Net integrates with each agent](https://ccsafetynet.com/docs/guides/integration-architecture.md): The four integration models behind CC Safety Net's twelve agents: stdin hook subprocesses, agent-loaded plugins, the in-process Pi extension, and the Amp Code event plugin. - [Known limitations and pitfalls](https://ccsafetynet.com/docs/guides/known-limitations.md): What CC Safety Net cannot catch: opaque command proxies, in-binary behavior, filesystem containment and network, symlink TOCTOU, interpreter flags, eval-based execution, the Codex interactive-session gap, and the Hermes Agent and OpenClaw coverage boundaries. - [Troubleshooting installation and behavior](https://ccsafetynet.com/docs/guides/troubleshooting.md): Fix common CC Safety Net issues: hook not firing, commands not blocked, false positives, custom rules not enforced, degraded configuration, and status line not showing. - [Contributing to CC Safety Net](https://ccsafetynet.com/docs/contributing.md): How to contribute to CC Safety Net: setup with Bun 1.3.14 and Node.js 18+, what bun run check covers, local plugin testing, code conventions, and the pull request checklist. - [Security policy](https://ccsafetynet.com/docs/security.md): How to report a security vulnerability in CC Safety Net, what counts as a security issue, supported versions, and response expectations.