Quick start

Install moat
macOS and Linux.
Terminal window
brew install crocodile-labs/tap/moat
macOS and Linux; puts moat in ~/.cargo/bin.
Terminal window
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/crocodile-labs/openmoat/releases/latest/download/openmoat-installer.sh | sh
PowerShell.
Terminal window
powershell -ExecutionPolicy Bypass -c "irm https://github.com/crocodile-labs/openmoat/releases/latest/download/openmoat-installer.ps1 | iex"
From crates.io, with Rust 1.95.
Terminal window
cargo install openmoat --locked

Set it up for your agents

moat init

moat init writes the default policy to ~/.moat, then lists the agents it finds and asks once for each:

Found these agents:
  Claude Code  /Users/you/.claude (changes settings.json)
  Codex        /Users/you/.codex (changes hooks.json, config.toml)
Protect Claude Code (/Users/you/.claude)? [Y/n]
Protect Codex (/Users/you/.codex)? [Y/n]

It backs up every file before it changes it. moat uninstall puts them all back.

Start your agent in a new session

Hooks are read when a session starts, so open a new one. Then work as usual: most calls run exactly as before.

Check that it works

moat status                            # each agent: hook + OS sandbox, hook only, or not protected
moat policy check "cat ~/.ssh/id_rsa"  # the verdict for a command, without running it

⛔ deny
   rules : secrets-paths
   reason: secret material: read /Users/you/.ssh/id_rsa
   also  : shell "cat ~/.ssh/id_rsa"

What next

How it decidesWhy some calls run, some go to your agent's prompt and a few are blocked.

Something was blockedWhat to do when a block gets in your way.

Work across several reposThe first thing most developers need.