manuelschipper/nah

What it solves

nah prevents AI coding agents from performing catastrophic actions—such as deleting the entire filesystem, stealing secrets, or wiping Git history—by intercepting tool calls before they are executed. It acts as a safety guard that blocks provably dangerous commands while leaving non-dangerous calls to the agent's existing runtime permissions.

How it works

Written as a static Rust binary, nah operates deterministically without using an LLM to make decisions. It parses tool calls into "typed effects" (e.g., file reads, network requests, process behavior) and checks them against a catalog of guards.

If a guard finds a definite violation, it returns a block verdict, which informs the agent why the action was refused. If no guard is triggered, it returns a delegate verdict, allowing the agent's own sandbox or approval flow to handle the request. Users can also build custom extensions in any language to add project-specific safety rules.

Who it’s for

Developers using AI coding agents (such as Claude Code, Cursor, or Devin) who want an automated layer of protection against accidental or malicious destructive commands.

Highlights

• Deterministic Safety: Uses a Rust binary rather than an LLM judge, ensuring microsecond response times and consistent results.
• Extensive Guard Catalog: Includes 46 built-in guards covering execution hijacks, secret theft, filesystem destruction, and infrastructure teardown.
• Broad Integration: Supports a wide range of agent runtimes including Claude Code, Cursor, and Copilot.
• fontenc-Self Protection: Blocks agents from attempting to disable nah or modify its configuration.
• Customizable: Allows users to toggle specific guards via a TUI or CLI and create custom guard programs.