Railguard — The Runtime Layer for AI Agents

Open-source · Rust · MIT

# The runtime
layer for AI agents
in production.

Every agent action passes through Railguard before it hits the world. One hook. Full control. Zero latency. On-device, nothing leaves your machine.

Star on GitHub →
Feb 26, 2026 — DataTalks.Club

Claude Code ran `terraform destroy` on a production stack. 2.5 years of student data. 1.9 million rows. Gone. Found out at midnight.

$ terraform destroy → VPC + RDS + ECS. Everything.
Feb 19, 2026 — GitHub Issue #27063

A background Claude agent autonomously ran `drizzle-kit push --force` against production PostgreSQL. 60+ tables. Months of data. Unrecoverable.

$ drizzle-kit push --force → 60 tables. No backup. Gone.

## Six features.
One floor.

What Railguard does
Intercept
Every agent action is caught before it executes — file writes, shell commands, API calls, database queries. Nothing gets through without passing Railguard first.
Hooks directly into Claude Code's native hooks system. No changes to your agent, your prompts, or your workflow.
Block
Configurable blocklist stops destructive commands cold. `terraform destroy`, `DROP TABLE`, `push --force` — define what's off-limits.
Pattern matching, command-level rules, and glob support. Works against any shell command, not just known bad actors.
Approve
Flag risky actions for human sign-off before they run. Agent pauses, you review, you decide. No agent code changes required.
Approval queue in the terminal or via webhook. Configurable per-command or per-risk-level. Timeout with deny as default.
Trace
Full structured audit log of every action, every session. Know exactly what your agent did, in what order, and why.
JSON output, session-scoped logs, timestamps, command args, and exit codes. Pipe to your existing observability stack.
Rollback
Undo any agent action in one command. `railguard rollback [id]` and you're back. Works for files, config edits, and more.
Automatic state snapshots before every intercepted write. Rollback is instant, atomic, and logged.
Policy
All rules defined in YAML, version-controlled alongside your code. One file, all your guardrails, always in sync with your team.
Supports blocklists, allowlists, approval thresholds, resource tagging, and environment-scoped overrides.
How it works

## Up in
60 seconds.

01
Install
One curl command. Railguard registers itself with Claude Code's native hooks system.
02
Configure
Drop a `railguard.yaml` in your project. Define blocklists, approval rules, protected resources.
03
Run your agent normally
Every action is intercepted before execution. Destructive commands are blocked or queued. You stay in control.
railguard — zsh
# install
$ curl -fsSL https://railguard.dev/install.sh | sh
$ railguard init
✓ hooked into Claude Code hooks system
✓ policy loaded · railguard.yaml
✓ runtime active · async · on-device · 0ms overhead
# run your agent as normal
$ claude "clean up duplicate AWS resources"
⛔ BLOCKED terraform destroy
rule: destructive-infra · railguard.yaml:14
action queued → railguard approve a3f9
Works with
Claude Code
Codex — coming soon
Kiro — coming soon

## Your agents are already
in production.
Is there a floor?

Star on GitHub →
MIT Licensed
Written in Rust
On-device
Free forever