Command-line interface

Create a secure starter configuration:

npx @agent-utils/agent-guard init

Check a policy decision

agent-guard check ./src/index.ts --operation read
agent-guard check ../secrets/.env --operation read

Exit codes are 0 for allow, 1 for deny, and 2 for ask.

Diagnostics

agent-guard doctor
agent-guard adapters list
agent-guard policy validate
agent-guard audit --tail 50
agent-guard audit --agent codex --decision deny --since 2026-10-01 --json

Agent hooks

Install or remove project-level hooks without replacing unrelated hook entries:

agent-guard adapters install claude-code
agent-guard adapters install cursor
agent-guard adapters install codex
agent-guard adapters uninstall cursor

Commit the generated project hook configuration if you want it shared with the repository. The hook command reads the host JSON event on stdin and is normally invoked by the generated configuration, not by hand.

Run a command

agent-guard run -- npm test

run does not sandbox the child process. Only operations performed through integrated Agent Guard SDK or MCP APIs are enforced.