Solution
What stops an agent with your terminal? Rules checked before each call runs.
Protect checks each tool call before your terminal runs it. With the rules you pick, a .env read, a push to main or rm -rf ~ never runs, and the model is told why.
Today it enforces Claude Code and Codex. Other agents are recorded, not enforced.
cat .env: your agent wants to read your keys.
.env and .env.*. Examples and templates are allowed. A hidden read such as cat $(echo .env) is read the same way.
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team's policy: Read environment files. .env files hold secrets.Your agent tells you it was blocked and carries on with other work.
git push origin main: your agent wants to ship with no review.
main, master, production and names that start with release/.
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team's policy: Push to protected branches. Protected branches change through reviewed pull requests.Your agent tells you it was blocked and carries on with other work.
sudo sh -c 'rm -rf ~': a bad guess about a path, inside two wrappers.
Read through wrappers such as sudo and sh -c.
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team's policy: Delete the root or home folder.Your agent tells you it was blocked and carries on with other work.
npm test: ordinary work.
Nothing is blocked until you choose rules. Then only calls that match your rules are blocked.
An agent with a shell works fast. One bad call is enough.
It reads a .env file and sends your keys to the model.
It force-pushes to main, with no review.
It runs rm -rf ~ after a bad guess about a path.
A check on one tool name misses calls. The same rm -rf ~ can come wrapped in sudo or sh -c, or through a tool with another name.
Checked on the way back from the model. Before your shell sees it.
- 01The model asks for a call
A shell command, a file read or write, a web fetch or a tool-server call.
- 02Protect reads what it does
Through wrappers such as sudo and sh -c, across 22 capabilities.
- 03It runs, or it never reaches your shell
A blocked call becomes a refusal. The model reads why and carries on.
Rules decide on the gateway, outside the model. The model cannot change them; it only reads the refusal. A rule is a list of conditions you can read and test, with no wildcards. Protect is off until you turn it on, and nothing is blocked until you pick a preset or add rules.
Tested on production. 42 of 103 cases try to get past it.
| Test | Result |
|---|---|
| API checks, production | 126 pass, 0 fail |
| Claude Code (Haiku 4.5), live | 25 pass, 0 fail, 1 skip |
| Codex, live | 22 pass, 0 fail, 1 skip |
| Refused calls with a side effect | None |
Five throwaway accounts in production, no customer traffic. What it does not catch: a script file, a compiled program or a path built at run time. Keep your agent's sandbox on too. Method and results →
One policy for every agent. Set once by the org.
On Team, the org sets the rules and agents cannot loosen them. For audit, the decision log and policy changes, see Protect for security teams.
What this uses.
Checks every tool call before it runs. In every plan, off until you turn it on.
Every rule type, the presets, the packs and the limits.
Related: Block .env reads, Protect your main branch, Block commands you cannot undo, For security teams.
Let the agent work. Keep the keys.
npx @context-mode/cli connects your agents. 1,000 requests free, no card.
For a team: sales@context-mode.com