Hardstop

🛑 Hardstop
👉 ⭐ Star on GitHub if Hardstop keeps you safe!

Pre-execution safety validation for AI coding agents. Validates every shell command against 428 security patterns before execution — blocking destructive operations, credential theft, infrastructure teardown, and prompt injection. Fail-closed: blocks by default when uncertain.

Ecosystem: The detection patterns are published separately as hardstop-patterns (GitHub) — reusable in any Node.js tool.

Installation • How It Works • Commands • Report Issue

⚡️ Why Hardstop?

You trust your AI, but you shouldn't trust it with rm -rf / or reading your ~/.aws/credentials. Hardstop sits between the LLM and your system, enforcing a strict Fail-Closed policy on dangerous operations.

- 🛡️ Pattern Matching: Instant regex-based detection for known threats (fork bombs, reverse shells)
- 🧠 LLM Analysis: Semantic analysis for edge cases and obfuscated attacks
- ⛓️ Chain Awareness: Scans every link in a command chain (&&, |, ;)
- 🔐 Secrets Protection: Blocks reading of credential files (.ssh, .aws, .env) *(v1.3)*
- 🍎 macOS Coverage: Keychain, diskutil, Time Machine, Gatekeeper, SIP, LaunchDaemons *(v1.3.6)*
- 📚 LLM Guidance: Teaches Claude how to think about safety, not just blocks

🚀 Quick Demo

Claude tries to ruin your day? Hardstop says no.

⚙️ How It Works

Hardstop uses a two-layer verification system for Bash commands and pattern-based protection for file reads.

The 428 detection patterns (Layer 1) are published as a standalone npm package: hardstop-patterns — usable in any Node.js tool, not just Hardstop.

🤝 Works Well With

PatchPilot - Package vulnerability scanner that blocks risky npm/pip/brew installations.

Use both for complete Claude Code security:

Why both? PatchPilot secures your dependencies,…