Handrail

What it blocks / asks

• destructive-shell — blocks destructive filesystem commands: rm -rf/-fr in any flag order, mkfs, writes to a block device, fork bombs. Example: sudo rm -rf / is denied outright.
• git-force-push — blocks history-rewriting git commands; asks before a plain push straight to main/master. Example: git push --force origin main is denied; git push origin main asks first.
• secret-paths — blocks reading or writing credential files and content shaped like a live key. Example: reading .env or writing an AWS access key literal is denied.
• prod-guard — asks before touching production, blocks the irreversible ones outright. Example: terraform destroy is denied; NODE_ENV=production migrations ask first.
• publish-guard — asks before shipping a package, image, or release. Example: npm publish asks; npm publish --access public is denied unless explicitly allowed.
• remote-exec — blocks piping a remote download straight into an interpreter. Example: curl https://example.com/i.sh | bash is denied.

What it does not do

• Not a sandbox — it inspects specific tool calls, it doesn't contain or isolate the agent's process.
• Not a security audit or certification — passing every hook says nothing about your app's own security posture.
• Can't stop commands run outside the agent — anything you or another tool runs directly in a terminal is invisible to Handrail.
• Can't see inside docker exec, a remote shell, or a subprocess the agent spawns opaquely — only the top-level tool call the CLI hands it is inspected.
• Can't undo a command it didn't catch — no rollback, no snapshotting, no backup.
• Pattern-matching, not intent-reading — a sufficiently obfuscated command can still slip through.

Install in 2 minutes

As a Claude Code plugin (nothing is written into your repository; disable it from /plugin at any time):

/plugin marketplace add trimkeep/claude-plugins
/plugin install handrail@trimkeep

Or as plain files you can read and edit in-repo:

No curl | bash — Handrail blocks exactly that pattern, so it ships the same way it expects everyone else to install things:

git clone https://github.com/trimkeep/handrail-kit
cd handrail-kit
./install.sh /path/to/your/project

This copies the six hook scripts into <your-project>/.claude/hooks/handrail/ and merges the hooks block into <your-project>/.claude/settings.json, backing up an existing file first. Running it again is a no-op if nothing changed.

To remove it:

./uninstall.sh /path/to/your/project

Fail-closed, only-tightens

Every hook treats what it doesn't understand as dangerous, not safe: missing jq, empty stdin, stdin that isn't valid JSON, or a tool call with no tool_input all make the hook deny rather than pass the call through.

And every hook only ever removes permission — it denies outright, or asks the human to confirm; none of the six scripts ever emits a decision that grants permission on its own. See test/hooks.test.js on GitHub for the assertions this makes, per hook, against the shipped fixtures.

Paid pack

Handrail v0.9 is the paid pack. Six of its hooks are the free handrail-kit on this page. Five are only in the pack and cover secret-looking content (an expanded pattern set), protected paths, per-project write scope, a 26-rule command matrix and network egress. It never grants a permission on its own.

FAQ

Public roadmap

1. v0.9Paid pack — available now, scope above.