Use case · Protect

# My agent ran one wrong rm -rf and I lost a day. *Stop it before it runs.*

Protect checks each tool call from Claude Code and Codex before your terminal runs it. With the Balanced preset, it blocks `rm -rf ~`, `terraform destroy` and `git reset --hard`, even inside sudo, sh -c and about 130 other wrappers, and the agent reads why.

[Get started free](https://console.context-mode.com/login) [Read the docs](https://context-mode.com/docs/protect#core-protections)

Your agent runs

rm -rf ~ Hidden in sudo, xargs terraform destroy git reset --hard rm -rf node_modules

A bad guess about a path. Your home folder is the target.

Blocked · never reaches your shell **Delete the root or home folder**

Core protections. On in Balanced and Locked down.

The call never reaches your shell. Nothing is deleted.

The same delete, written other ways.

```
sudo sh -c 'rm -rf ~'   blocked
echo / | xargs rm -rf   blocked
T=/; rm -rf $T          blocked
cd ~ && rm -rf *        blocked
sh <<< 'rm -rf ~'       blocked
```

Protect reads what a call does, through sudo, sh -c, xargs and about 130 other wrappers.

The agent tears down your infrastructure to start clean.

Blocked · never reaches your shell **Destroy infrastructure**

terraform, tofu, terragrunt, pulumi and cdk destroy.

```
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team’s policy: Destroy infrastructure. Infrastructure is torn down only through CI.
Scope: your account. …
```

Shortened. The model reads the rule and why, and carries on.

You asked for a clean branch. You had half-done edits.

Blocked · never reaches your shell **Discard local work**

git reset --hard, git clean -f, -fd and -fdx, git restore . over the whole tree.

Your edits and untracked notes stay. The agent offers git stash -u instead.

Ordinary cleanup.

Runs **No rule matches**

A project folder is fine. Core protections covers only losses you can't undo.

```
$ rm -rf node_modules
$ npm install
```

Core protections does not block installs, tests or commits.

The problem

## Your agent runs commands fast. *Some losses you cannot undo.*

**A bad guess about a path**

The agent means a build folder and runs `rm -rf ~`. Your home folder is gone.

**A clean start that is not clean**

It runs `terraform destroy` or drops a table to fix a test. Production goes with it.

**Half-done work thrown away**

You ask for a clean branch. It runs `git reset --hard`, and your edits and untracked notes are lost.

How it works

## Read what the call does. *Decide before it runs.*

1. 01 **Turn on Protect** In the console, open Protect, turn it on, and pick the Balanced preset. Core protections and Destroy infrastructure are on in it.
2. 02 **Protect reads what the call does** A shell command, a file delete, a Codex patch or a one-line program. It reads through 98 wrapper words and 33 carriers, such as sudo, sh -c, xargs, find -exec and ssh.
3. 03 **Blocked calls never run** The client runs a short refusal instead. The model reads the rule and why, and carries on.

**Your agent**Asks to run `sudo sh -c 'rm -rf ~'`.

→

**Context Mode · Protect**Checks the call in Context Mode, before your client runs it.

- Delete the root or home folder: blocked
- Destroy infrastructure: blocked
- Discard local work: blocked
- rm -rf node_modules: runs

→

**The model**Gets the refusal as the tool result. Your home folder is still there.

Your agent asks for a delete. Protect, the box in the middle, decides before the shell runs anything. Ordinary cleanup still runs.

Proof

## Tested on production. *Wrapped forms too.*

**42** of the 103 matrix cases try to get past the rules, not use them as written **3 of 3** live runs blocked `git reset --hard` and `git clean -fd`, with no file lost

| Your agent runs | Protect | Rule |
| --- | --- | --- |
| `rm -rf ~` , `rm -rf /` , `rm -rf /usr` | Blocked | Delete the root or home folder |
| `echo / \| xargs rm -rf` , `T=/; rm -rf $T` | Blocked | Delete the root or home folder |
| `dd of=/dev/disk2` , `mkfs.ext4 /dev/sda1` | Blocked | Wipe or format a disk |
| `terraform destroy` , `pulumi destroy` | Blocked | Destroy infrastructure |
| `psql -c` with DROP TABLE | Blocked | Drop tables or databases |
| `git reset --hard` , `git clean -fd` | Blocked | Discard local work |
| `rm -rf node_modules` , `rm -rf /tmp/build` | Runs | No rule matches |

Rules as set by the Balanced preset. Protect reads the call, not the program: a script file, a compiled program or a path built at run time gets past it, so keep your agent's sandbox on. [Method and sources →](https://context-mode.com/blog/protect-rules-for-coding-agents#proof)

Products used

## What this *uses.*

**[Protect](https://context-mode.com/protect)**

Checks every tool call before your terminal runs it. Off until you turn it on.

**[Protect docs](https://context-mode.com/docs/protect)**

Core protections, the packs, what still runs and what it does not catch.

**[How we tested it](https://context-mode.com/blog/protect-rules-for-coding-agents)**

The production test run, the bypass cases and what is still open.

**[Plans](https://context-mode.com/pricing)**

Protect is in every plan. Start free.

Related: [Protect main](https://context-mode.com/use-cases/protect-main-branch) · [Keep .env files away from the model](https://context-mode.com/use-cases/block-env-secrets) · [One policy for the team](https://context-mode.com/use-cases/team-agent-policy) · [Secure coding agents](https://context-mode.com/solutions/secure-coding-agents)

## Let your agent work. *Keep your files.*

*npx @context-mode/cli* connects your agents. 1,000 requests free, no card.

[Get started free →](https://console.context-mode.com/login) [Read the docs →](https://context-mode.com/docs/protect#core-protections)