What it blocks
Secret files, for any stack
.env and its variants (but not templates like .env.example), .envrc, .dev.vars, .npmrc, .pypirc, .netrc, Rails master.key, secrets.*, wp-config.php, Terraform *.tfvars and *.tfstate, private keys and certificates, service-account JSON, and ~/.ssh, ~/.aws and ~/.kube/config. The list is editable.
Environment dumps
Commands that print your environment: env, printenv, export -p, set, ps eww, echo $API_KEY and Keychain password reads.
One-line scripts that read environment variables
The route agents take when the direct one is closed: python -c, node -e, ruby -e, php -r, perl -e, deno eval, awk with ENVIRON and similar.
Destructive commands
rm -rf ~, git reset --hard, git clean -f, force pushes, DROP DATABASE, curl | sh, sudo, terraform destroy and others. Each rule can block outright or pause until you approve.
| The agent tries | Rollcage | Why |
|---|---|---|
cat .env.local | Blocked | Secret file |
printenv | Blocked | Dumps environment variables |
python3 -c "import os; print(os.environ)" | Blocked | Reads env vars in code |
rm -rf ~ | Blocked | Deletes your home folder |
git reset --hard | Asks you | Throws away uncommitted work |
git push --force | Asks you | Rewrites shared history |
cat .env.example | Allowed | Template, no secrets |
How it plugs into each agent
| Agent | Config file | Hook |
|---|---|---|
| Claude Code | ~/.claude/settings.json | PreToolUse on every tool |
| Codex CLI | ~/.codex/hooks.json | PreToolUse on shell commands and patches |
| Cursor | ~/.cursor/hooks.json | beforeReadFile, beforeShellExecution, beforeMCPExecution |
| Gemini CLI | ~/.gemini/settings.json | BeforeTool on every tool |
Turning the Guard on adds one hook entry to each file and leaves your own hooks in place. The original file is backed up next to it first, and turning the Guard off removes only Rollcage's entry. Restart agents that were already running. If you'd like to see how these hooks work underneath, read the guides to Claude Code hooks and Cursor security.
Try a command before an agent does
The Guard tab has a tester. Type any command and see whether it would be blocked, paused for approval or allowed, and which rule decided.
Every block is logged
Blocked and paused actions appear in the Activity timeline with the agent, the command and the rule, and in the menu-bar count for the day.
What it can't do
Hooks are a guardrail inside each agent. They see the tool calls an agent makes, not what happens inside a program the agent writes to a file and then runs. Keep production keys out of local .env files and give agents test keys. The secrets leak scan shows you any key that did end up in a transcript.
The Guard works with Claude Code, Codex CLI, Cursor and Gemini CLI, the agents that offer hooks. For the others, snapshots and the mass-delete alarm still apply.
Questions
Does the Guard slow agents down?
Each check adds a few milliseconds to a tool call. It's a small local program with no network requests.
Does it work when the agent runs in YOLO mode?
Hooks run before tool calls in any permission mode, so the checks still happen when prompts are skipped. Rules set to ask rely on the agent's own approval prompt, so for unattended runs set the rules you care about to block. And keep snapshots on: they don't depend on the agent at all.
Can I change the rules?
Yes. The secret-file list and the command rules are editable, and each command rule can be set to block or to ask.
Will it break my existing hooks?
No. Rollcage appends its own entry and leaves the rest of the file alone. If a config file isn't plain JSON, Rollcage doesn't touch it and tells you.