guardrail plugins

by Stop That Shit contributors

Keep Codex tasks bounded and reduce defensive wording with local-first guardrails and two Skills.

by Stop That Shit contributors

Keep Codex tasks bounded and reduce defensive wording with local-first guardrails and two Skills.

by widnyana

Denies git commands that stage protected paths, whole-tree adds, or rewrite history.

by widnyana

PreToolUse/Bash hook that blocks IaC write/destructive commands (ansible-playbook/ansible-pull without --check, ad-hoc ansible write modules, terragrunt/tofu/terraform apply-family including mise-wrapped forms), so agents never apply changes to real infrastructure.

by Nanako0129

Stop hook that catches a turn stopping half-done and pushes Codex back to finish it.

by devantler-tech

Build a product by conversation alone — a plain-language build companion agent plus skills for needs-to-stack translation, an allowed-stack guardrail, and a jargon-free voice; for people with no technical background

by Alexandre Oliveira

Refuses the hand-edit of a governed roadmap, changelog or rationale file and names the command to call instead, runs the gate as the turn ends, and offers add, ship, pick and lint as MCP tools and as slash commands over the one engine.

by Lazy Ants

Stop AI coding agents from accidentally emptying your database. Ships an always-on hook that blocks destructive DB commands (DROP, TRUNCATE, DELETE-without-WHERE, migrate:fresh, db:drop, prisma migrate reset, FLUSHALL, docker compose down -v and more) across 15+ frameworks, plus a stack-aware installer for database-level privilege separation and framework boot guards.

by Andre Paat

PreToolUse gate that blocks Bash commands with no practical local undo — de-obfuscates ssh/docker-exec transports, heredocs, command chains, and env prefixes, then matches a tiered deny-set (irreversible-everywhere ops block unconditionally; locally-reversible ops block only when the command names production)

by yukineko

Per-session concurrency cap for Claude Code. A PreToolUse hook counts the Bash calls and subagents actually in flight for this session and denies the call that would exceed the cap (3 shells and 3 subagents by default); PostToolUse gives the slot back and the ledger is cleared at every turn boundary. Enforcement lives in a bundled binary, not in prose a model may ignore. Subscription-native (no API key).

by Karl Isenberg

Blocks secrets and PII before they reach the API: scans the prompt, a Read path, a Bash command, and the files each one would open, then denies the call rather than letting it cross.

by yukineko

Stuck-loop detector + escalation for Claude Code: a PostToolUse hook that spots repeated identical actions and edit thrash, then injects an escalating nudge to change approach or ask the user for help. Subscription-native (one hook + bundled Rust binary, no API key).