Secure runtime for Claude Code. Run at full speed while Railguard enforces the guardrails that matter — command blocking, memory safety, path fencing, and recovery.
Babysit every command, or skip permissions and risk production.
Safe commands fly through. Dangerous ones never run.
Babysit every command, or skip permissions and risk production.
Safe commands fly through. Dangerous ones never run.
“This is awesome and so needed right now. I was going mad because I can't do the babysitting but DSP is kind of wild right now so I'm definitely checking this out and starring it.”
“This looks really useful! I like how you added OS-level sandboxing and deterministic guardrails instead of relying on LLM-based intent checks — that feels much safer for running autonomous agents.”
“The OS level isolation is really good of course. Just curious if I might want to switch.”
“That's nice work guys.”
“This is awesome and so needed right now. I was going mad because I can't do the babysitting but DSP is kind of wild right now so I'm definitely checking this out and starring it.”
“This looks really useful! I like how you added OS-level sandboxing and deterministic guardrails instead of relying on LLM-based intent checks — that feels much safer for running autonomous agents.”
“The OS level isolation is really good of course. Just curious if I might want to switch.”
“That's nice work guys.”
sandbox-exec (macOS) / bwrap (Linux). Catches encoded commands, pipe chains, and helper scripts that would evade pattern matching alone.railguard memory verify.~/.ssh, ~/.aws, ~/.gnupg, and /etc are fenced by default. Add your own in railguard.yaml.~/.ssh, ~/.aws are fenced by default. Add your own.railguard.yaml.railguard locks to see all active locks across sessions.railguard dashboard for live view. railguard replay --session <id> for history. Search, filter, and expand any action.railguard rollback.railguard rollback.cargo install railguard. Railguard registers hooks with Claude Code, configures the sandbox, and loads the default policy.cargo install railguard. Hooks, sandbox, and policy configured automatically.railguard.yaml in your project. Define blocklists, allowlists, and approval rules. Changes take effect instantly — no restart.railguard.yaml in your project. Define what to block.claude --dangerously-skip-permissions knowing Railguard has your back. Run multiple sessions. Ship faster. Nothing dangerous gets through.Install Railguard. It intercepts every Claude Code action before it executes — safe commands fly through instantly, dangerous commands like terraform destroy or rm -rf are blocked. You get the speed of --dangerously-skip-permissions without the risk.
No. Sandboxes restrict where your agent can work — they limit file access, network, and tools. Railguard only restricts what commands your agent can run. Your agent keeps full access to your project, your tools, and your workflow. It just can't run the commands that would destroy production.
It skips all permission checks, letting Claude Code execute any command without asking for approval. It's fast, but it means destructive commands like terraform destroy or DROP TABLE run without any safety net. Railguard makes this flag safe to use.
Railguard blocks whatever you configure in railguard.yaml. Common blocklist entries include terraform destroy, rm -rf, DROP TABLE, push --force, and drizzle-kit push --force. You can also flag commands for manual approval.
Railguard currently works with Claude Code via its native hooks system. Support for OpenAI Codex and Kiro is coming soon.
Under 2ms per command. 99% of commands execute instantly. Railguard runs on-device — nothing leaves your machine, no network calls, no cloud dependency.