cli-guard is a security-boundary framework for urfave/cli v3 applications, designed to sit between AI agents (or any semi-trusted automation) and the host system, featuring:
- argv validation rejecting shell metacharacters before they reach
execve - append-only JSONL audit log with lumberjack rotation
- read / write / delete scope tokens, validated per verb
--commit-scoperesolution binding every audit row to a git toplevel- clean+synced gate refusing repo-shaped verbs on a dirty tree
- per-repo command allowlist loaded from per-repo YAML config files (e.g.
.ward/ward.yaml,.coily/coily.yaml) - thin pass-through wrapper for embedding existing CLIs as audited subcommands
- per-invocation CONNECT proxy with consumer-supplied egress allowlist
- public exit-code taxonomy for orchestrators
- reusable dispatch subsystem firing
claudeagainst a real open issue, headless or interactive
See docs/FEATURES.md for a feature inventory, examples/ for runnable demos one per primitive, and the CLI reference for the rendered command tree of every example. Local dev verbs run through make (see the Makefile).
If you found a bug or have a feature request, create a new issue. Participation in this community is governed by the Code of Conduct. Security disclosures go through SECURITY.md.
Sibling repo: cli-mcp.
See LICENSE.
- AGENTS.md - agent-facing operating rules.
- docs/FEATURES.md - inventory of what ships today.
Cross-reference convention from coilysiren/agentic-os#59.