Solution

# What stops an agent with your terminal? *Rules checked before each call runs.*

Protect checks each tool call before your terminal runs it. With the rules you pick, a `.env` read, a push to `main` or `rm -rf ~` never runs, and the model is told why.

Today it enforces Claude Code and Codex. Other agents are recorded, not enforced.

[Get started free](https://console.context-mode.com/login) [Read the docs](https://context-mode.com/docs/protect)

Pick a call

cat .env git push origin main sudo sh -c 'rm -rf ~' npm test

cat .env: your agent wants to read your keys.

Blocked · never reaches your shell **Read environment files**

.env and .env.*. Examples and templates are allowed. A hidden read such as cat $(echo .env) is read the same way.

```
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team's policy: Read environment files. .env files hold secrets.
```

Your agent tells you it was blocked and carries on with other work.

git push origin main: your agent wants to ship with no review.

Blocked · never reaches your shell **Push to protected branches**

main, master, production and names that start with release/.

```
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team's policy: Push to protected branches. Protected branches change through reviewed pull requests.
```

Your agent tells you it was blocked and carries on with other work.

sudo sh -c 'rm -rf ~': a bad guess about a path, inside two wrappers.

Blocked · never reaches your shell **Core protection: delete the root or home folder**

Read through wrappers such as sudo and sh -c.

```
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team's policy: Delete the root or home folder.
```

Your agent tells you it was blocked and carries on with other work.

npm test: ordinary work.

Runs **No rule matches**

Nothing is blocked until you choose rules. Then only calls that match your rules are blocked.

The problem

## An agent with a shell works fast. *One bad call is enough.*

**Your secrets**

It reads a `.env` file and sends your keys to the model.

**Your main branch**

It force-pushes to `main`, with no review.

**Your home folder**

It runs `rm -rf ~` after a bad guess about a path.

A check on one tool name misses calls. The same `rm -rf ~` can come wrapped in `sudo` or `sh -c`, or through a tool with another name.

How it works

## Checked on the way back from the model. *Before your shell sees it.*

Protect sits in the gateway. It checks the call the model asks for before your agent runs it. A blocked call comes back as a short refusal.

1. 01 **The model asks for a call** A shell command, a file read or write, a web fetch or a tool-server call.
2. 02 **Protect reads what it does** Through wrappers such as sudo and sh -c, across 22 capabilities.
3. 03 **It runs, or it never reaches your shell** A blocked call becomes a refusal. The model reads why and carries on.

Rules decide on the gateway, outside the model. The model cannot change them; it only reads the refusal. A rule is a list of conditions you can read and test, with no wildcards. Protect is off until you turn it on, and nothing is blocked until you pick a preset or add rules.

Proof

## Tested on production. *42 of 103 cases try to get past it.*

**126 of 126** Protect API checks pass on production **42 of 103** test cases try to sneak past the rules **32 to 556 µs** to decide one call, inside the gateway

| Test | Result |
| --- | --- |
| API checks, production | 126 pass, 0 fail |
| Claude Code (Haiku 4.5), live | 25 pass, 0 fail, 1 skip |
| Codex, live | 22 pass, 0 fail, 1 skip |
| Refused calls with a side effect | None |

Five throwaway accounts in production, no customer traffic. What it does not catch: a script file, a compiled program or a path built at run time. Keep your agent's sandbox on too. [Method and results →](https://context-mode.com/blog/protect-rules-for-coding-agents#proof)

For a team

## One policy for every agent. *Set once by the org.*

On Team, the org sets the rules and agents cannot loosen them. For audit, the decision log and policy changes, see [Protect for security teams](https://context-mode.com/solutions/security-teams).

[Talk to us](mailto:sales@context-mode.com) [For security teams](https://context-mode.com/solutions/security-teams)

Products used

## What this *uses.*

**[Protect](https://context-mode.com/protect)**

Checks every tool call before it runs. In every plan, off until you turn it on.

**[Protect docs](https://context-mode.com/docs/protect)**

Every rule type, the presets, the packs and the limits.

Related: [Block .env reads](https://context-mode.com/use-cases/block-env-secrets), [Protect your main branch](https://context-mode.com/use-cases/protect-main-branch), [Block commands you cannot undo](https://context-mode.com/use-cases/block-destructive-commands), [For security teams](https://context-mode.com/solutions/security-teams).

## Let the agent work. *Keep the keys.*

*npx @context-mode/cli* connects your agents. 1,000 requests free, no card.

[Get started free →](https://console.context-mode.com/login) [Read the docs →](https://context-mode.com/docs/protect)

For a team: [sales@context-mode.com](mailto:sales@context-mode.com)