OpenMoat documentation

OpenMoat runs on your machine, next to Claude Code, Codex or Cursor. Before the agent runs a command, reads or writes a file, opens a web page or calls an MCP tool, OpenMoat checks it against one policy that you control. Normal work goes on as before; reading your keys, sending them out, destructive commands and switching OpenMoat off are blocked.

Start here

Quick startInstall, set it up for your agents and see your first block, in about a minute.

How it decidesThe four answers (allow, defer, ask, deny) and the layers behind them.

Something was blockedWhat each message means and the one command that fixes it.

CommandsEvery moat command on one page.

Everyday use

Each guide starts from a situation you will meet, shows what you see, and gives one command for it.

Work across several reposLet the agent read and edit folders outside the project with moat allow --dir.

Let the agent use a siteDocs, an API or a registry the policy does not list yet: moat allow --site.

Keep a token from the agentThe agent holds a placeholder; OpenMoat sends the real token to one host only.

See what the agent didToday's decisions, one session as a timeline, a weekly report.

Check a command firstThe verdict for any command, without running it.

Change the rulesEdit the policy safely: checked, diffed, and undoable.

Common setups

The project folderWhat the agent may do freely, and how monorepos, worktrees and submodules count.

.env and variablesWhich secrets in files and variables are denied, and how to add your own.

GitHub and ghCommits, pushes, pull requests and the gh token.

Local servicesDev servers, databases and Docker.

Cloud CLIs and SSHWhy aws, kubectl and ssh cannot use your credentials from the agent.

Install and publishInstalls, install scripts and publishing.

Before you allow anything

Every allow, and what it opens puts each moat allow side by side: what it covers, how long it lasts and what stays protected.

What it is not

Note

OpenMoat is not an AI model and does not guess. Written rules decide, so the same call gets the same answer every time, in about 10 ms. Nothing leaves your machine unless you export it. It does not replace your agent’s own prompt or sandbox; it fills the gaps between them. What it cannot see is listed in Limits.