Beta: latest release 0.1.0. The policy format and commands may still change before 1.0.

Security for AI coding agents

One local policy decides what Claude Code, Codex and Cursor may run, read, write and send, and the same policy configures every layer that enforces it: the agent's hook, its OS sandbox, the network and its secrets. What each layer stops is tested in CI and published in the evidence.

Works with Claude Code, Codex and Cursor, with more agents to come. Built by Crocodile Labs. The command is moat.

• Single Rust binary
• About 10 ms per check
• No AI model decides
• Blocks when its own check fails
• Published evidence
• Nothing leaves your machine unless you export it

Install

1. brew install crocodile-labs/tap/moatHomebrew on macOS and Linux.

2. moat initLists the agents it found and asks before changing each one. It backs up every file first; moat uninstall undoes it.

3. moatWhen something is blocked or asked: shows which agents are protected, today's decisions, and anything that needs you. It changes nothing unless you answer.

Then start your agent as usual. Every tool call now goes through OpenMoat. Other installers (shell script, PowerShell for Windows, cargo install openmoat): install guide.

See it work

"My agent already asks me before it runs things."

The agent's prompt shows you the command, not what the command does. And nobody checks what happens after you click "yes". OpenMoat does.

• Hidden code

  A harmless-looking npm test can run code that reads ~/.ssh. OpenMoat configures the operating system's sandbox from the policy, so code hidden inside an approved command still cannot read your secrets or write outside the project.

• Fewer prompts, read properly

  Normal work runs without interruption. You are asked only when the policy says ask, and told why, so the prompts that remain get read.

• Tricks people miss

  echo Y3VybC… | base64 -d | sh, nested shells, or a symlink that points into ~/.ssh. OpenMoat parses the shell, decodes and resolves paths before deciding.

• When nobody is watching

  Auto-approve modes, CI and background agents show no prompt at all. OpenMoat still works there.

• The agent cannot widen its own rules

  The agent cannot edit, approve or switch off OpenMoat. If its policy or settings change behind its back, everything is blocked until you review.

• Two harmless steps, one attack

  After a session reads a secret, its network and MCP calls are asked about (session-taint).

• One policy, with a record

  The same rules for Claude Code, Codex and Cursor, and every decision in a local audit log that detects tampering.

Someone who uses only one agent, reads every prompt carefully and never uses auto-approve gets less extra value from OpenMoat.

Allow, ask, deny

Before the agent runs a command, reads or writes a file, opens a web page or calls an MCP tool, OpenMoat checks the action against one policy that you control.

• ✓ Allow

  Normal work runs without interruption, and is recorded.

• ? Ask

  You are asked first, and told why.

• ⛔ Deny

  The action is blocked. The agent is told which rule matched and why.

What a deny looks like:

$ moat policy check "cat ~/.ssh/id_rsa"
⛔ deny
   rules : secrets-paths
   reason: secret material: read /Users/you/.ssh/id_rsa
   also  : shell "cat ~/.ssh/id_rsa"

The full table, and how to test your own commands.

One policy, every layer

The hook allows project scripts such as npm test and cannot see what they do. So the same policy also configures the operating system's sandbox: OpenMoat's own moat run, and each agent's sandbox as moat init sets it up. CI runs hostile test scripts under every layer, with fake secrets and no internet, on every pull request, and fails when a result changes.

On Linux, moat run uses Landlock, which can only grant access, so it cannot deny a path inside the project; the hook still denies those files for the agent's own tool calls. On Windows these layers are not verified: OpenMoat generates no OS sandbox there, Claude Code's sandbox does not run on native Windows, and the Codex test scripts are POSIX shell.

Every case, payload and error code in EVIDENCE.md (Claude Code 2.1.290, codex-cli 0.160.1).

What it protects

• Your secrets

  SSH keys, cloud credentials, tokens and .env files stay out of reach. The secrets broker gives the agent a placeholder instead of the real token and blocks any request that would carry it to the wrong host.

• Your files and history

  Recursive deletes of your home directory, force pushes, hard resets and edits to shell startup files are blocked.

• Your network

  Agents connect only to destinations the policy allows. Cloud metadata and local network addresses are refused.

• OpenMoat itself

  The agent cannot edit, approve or switch off OpenMoat. If its policy or settings change behind its back, everything is blocked until you review.

• A record of everything

  Every decision goes into a local audit log that detects tampering and can be exported and verified by your team.

Limits

What OpenMoat does not stop today:

• Cursor runs a command outside the sandbox OpenMoat configures when its Auto-review classifier approves it, in Run Everything mode, and in the Cursor CLI without --sandbox enabled; inside the workspace its sandbox cannot deny .env or .git. Claude Code's sandbox covers only Bash, PowerShell and Monitor. moat run covers a whole agent but is weaker per command.
• Allowed scripts (npm test, make test) run whatever they contain; the sandbox bounds them, OpenMoat does not inspect them. On Linux, moat run leaves .env in the project readable.
• Hosts the policy allows (api.github.com, the registries) can receive data from an allowed or approved command.
• Tools no hook exposes are not seen (Claude Code WebSearch, Codex web search).
• If the hook binary is missing, the agent still runs the call.
• The released Continue CLI (cn) does not run hooks yet; use moat run.

The full list, with the reasons: threat model.

Open source, local, no AI deciding

• Deterministic

  No AI model decides. When OpenMoat is unsure or something fails, it blocks.

• Local

  Everything runs on your machine. The audit log is a SQLite file in ~/.moat, credentials are redacted before they are stored, and nothing leaves your machine unless you export it.

• Open source

  MIT or Apache-2.0, at your option. Report a bypass privately through the security policy; valid bypasses become conformance fixtures before the fix is published.