Cloneguard

CloneGuard

  Your AI agent reads untrusted repos. CloneGuard watches what it does next.

Hook-level defense for AI coding agents. Detects prompt injection, constrains
suspicious tool calls, and emits structured audit logs -- before the agent
executes. The agent cannot disable it because CloneGuard runs at the hook layer,
outside the agent's control.

Built for Claude Code and Gemini CLI. Standalone scanning works with any agent.
Active development (v0.6.0) -- feedback and contributions welcome.

See It In Action

  A repo with a hidden .clinerules payload — CloneGuard catches it on scan.

More demos

Behavioral sequence detection — reads .env, then tries to curl the data out. First step allowed, second step blocked.

Package hallucination — agent tries to install a package that doesn't exist on PyPI.

Quick Start

That's it. CloneGuard is now scanning every tool call in Claude Code. No config
files to write, no agent restart required.

Want the semantic classifier (recommended):

What It Catches

- Prompt injection patterns -- 240 rules across 34 categories, from
  instruction override to reasoning hijack to MCP tool poisoning
- Behavioral sequences -- credential file read followed by network
  exfiltration attempt (SEQ-001), config writes for privilege escalation
  (SEQ-005), and more
- Package hallucination -- agent tries to install a package that doesn't
  exist on PyPI/npm. If an attacker had registered that name first, you'd be
  running their code
- Sensitive file access -- detects reads of credentials, SSH keys, and
  environment files in suspicious context

How It Works

Four defense layers, each running before the agent can act:

Detection signals:

When a detection fires, CloneGuard can report it (default), constrain the tool
call via OS-level sandbox, or…