Use case · Protect
My agent ran one wrong rm -rf and I lost a day. Stop it before it runs.
Protect checks each tool call from Claude Code and Codex before your terminal runs it. With the Balanced preset, it blocks rm -rf ~, terraform destroy and git reset --hard, even inside sudo, sh -c and about 130 other wrappers, and the agent reads why.
A bad guess about a path. Your home folder is the target.
Core protections. On in Balanced and Locked down.
The call never reaches your shell. Nothing is deleted.
The same delete, written other ways.
sudo sh -c 'rm -rf ~' blocked echo / | xargs rm -rf blocked T=/; rm -rf $T blocked cd ~ && rm -rf * blocked sh <<< 'rm -rf ~' blocked
Protect reads what a call does, through sudo, sh -c, xargs and about 130 other wrappers.
The agent tears down your infrastructure to start clean.
terraform, tofu, terragrunt, pulumi and cdk destroy.
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team’s policy: Destroy infrastructure. Infrastructure is torn down only through CI.
Scope: your account. …Shortened. The model reads the rule and why, and carries on.
You asked for a clean branch. You had half-done edits.
git reset --hard, git clean -f, -fd and -fdx, git restore . over the whole tree.
Your edits and untracked notes stay. The agent offers git stash -u instead.
Ordinary cleanup.
A project folder is fine. Core protections covers only losses you can't undo.
$ rm -rf node_modules $ npm install
Core protections does not block installs, tests or commits.
Your agent runs commands fast. Some losses you cannot undo.
The agent means a build folder and runs rm -rf ~. Your home folder is gone.
It runs terraform destroy or drops a table to fix a test. Production goes with it.
You ask for a clean branch. It runs git reset --hard, and your edits and untracked notes are lost.
Read what the call does. Decide before it runs.
- 01Turn on Protect
In the console, open Protect, turn it on, and pick the Balanced preset. Core protections and Destroy infrastructure are on in it.
- 02Protect reads what the call does
A shell command, a file delete, a Codex patch or a one-line program. It reads through 98 wrapper words and 33 carriers, such as sudo, sh -c, xargs, find -exec and ssh.
- 03Blocked calls never run
The client runs a short refusal instead. The model reads the rule and why, and carries on.
sudo sh -c 'rm -rf ~'.- Delete the root or home folder: blocked
- Destroy infrastructure: blocked
- Discard local work: blocked
- rm -rf node_modules: runs
Tested on production. Wrapped forms too.
git reset --hard and git clean -fd, with no file lost| Your agent runs | Protect | Rule |
|---|---|---|
rm -rf ~, rm -rf /, rm -rf /usr | Blocked | Delete the root or home folder |
echo / | xargs rm -rf, T=/; rm -rf $T | Blocked | Delete the root or home folder |
dd of=/dev/disk2, mkfs.ext4 /dev/sda1 | Blocked | Wipe or format a disk |
terraform destroy, pulumi destroy | Blocked | Destroy infrastructure |
psql -c with DROP TABLE | Blocked | Drop tables or databases |
git reset --hard, git clean -fd | Blocked | Discard local work |
rm -rf node_modules, rm -rf /tmp/build | Runs | No rule matches |
Rules as set by the Balanced preset. Protect reads the call, not the program: a script file, a compiled program or a path built at run time gets past it, so keep your agent's sandbox on. Method and sources →
What this uses.
Checks every tool call before your terminal runs it. Off until you turn it on.
Core protections, the packs, what still runs and what it does not catch.
The production test run, the bypass cases and what is still open.
Protect is in every plan. Start free.
Related: Protect main · Keep .env files away from the model · One policy for the team · Secure coding agents
Let your agent work. Keep your files.
npx @context-mode/cli connects your agents. 1,000 requests free, no card.