Tested by SkillHammer Hooks, skills and an n8n workflow for Claude Code and Cursor

Agent Guardrails Kit

Stop Claude Code and Cursor agents deleting the wrong folder, force-pushing main or reading .env.

On 17 Oct 2026 a Cursor user reported that the agent ran a cmd /c rmdir command whose quoting broke; most of a 1 TB drive was deleted with no prompt. Agents also read .env files, print the environment and force-push.

This kit checks every shell command and file read before it runs and answers allow, ask or deny, with a reason your agent can act on. It fails closed: if the check can't run, the action is blocked.

Everyday work isn't slowed down. And when something has gone wrong, there's an undoable delete, a first-ten-minutes runbook and optional Slack alerts through n8n.

What's in the download

• guard/agent_guard.py: one hook for Claude Code and Cursor (23 rules, Python 3.9+, no dependencies) and policy.json
• install/install.py and install/selftest.py: backs up, keeps your settings, re-runnable, --uninstall
• 3 skills: safe-delete (undoable delete), agent-incident-stop (runbook + read-only snapshot), secret-hygiene (masked secret scanner + rotation checklist)
• n8n/agent-guard-alerts.json: optional HMAC-signed Slack alerts
• README, SETUP.md, the full test suite, TEST-REPORT.md, LICENSE.txt, REFUND.txt

Who it's for

Developers and small teams who let Claude Code or Cursor run commands on their own machines, especially on Windows or with production credentials nearby.

What's tested

• 379 guard decision tests: 174 shell commands (146 bash/zsh, 28 PowerShell/cmd.exe) in both the Claude Code and Cursor formats, plus file-tool, policy and everyday-command checks
• 19 tests of the real hook process (output format, exit codes, fail-closed cases, audit masking, signed alerts, latency) and 9 installer tests
• 15 skill tests that run the three scripts on real files and git repos, including the kit's own secret scanner over the whole kit (0 findings)
• 16 n8n tests, including 12 end-to-end in a real local n8n 2.43.7 (Node 24) with the real guard sending signed alerts, plus 3 harness fail-fast tests

What isn't tested

• Not yet run inside the real Claude Code or Cursor apps; hook input and output follow each tool's documentation
• Windows/PowerShell support is parser-tested (28 PowerShell and cmd.exe commands); not run on a Windows machine or on macOS
• Real Slack (mocked), n8n Cloud and concurrent replayed alerts
• A guard sees command text, not what a script does once it runs

Read the full TEST-REPORT

Requirements

Python 3.9+. Claude Code 2.1.295 or later and/or Cursor with hooks. Optional: self-hosted n8n and a Slack incoming webhook for alerts. One licence per person (everyone who uses it or whose agent it guards; CI runners don't need one).

How to use it

Run python3 install/install.py --project /path/to/repo, then install/selftest.py, and restart Claude Code or reload Cursor. Copy the skills into your skills folder.