Your coding agents cannot reach production.
Proven with tests, in your CI.
Guardrails for teams on Claude Code and Cursor. Installed in your repos in five evenings. You pay after the test suite passes.
מעקות בטיחות לסוכני קוד: מותקנים ברפו שלכם, מוכחים בבדיקות ב-CI, משלמים רק אחרי שהבדיקות עוברות.
Where do you stand today? Paste your settings.json and CLAUDE.md into the grader. Score out of 10, the specific gaps, nothing uploaded. For a full exposure report with a repo scan (secret files, secret-looking strings, writable pipelines), run gates/exposure_report.py from the kit locally, or send me the two files and get it written within 48 hours. See a sample report. Or take the free kit: agent-guardrails-kit on GitHub, 125 passing assertions.
Why now
On 25 April 2026 a Cursor agent at PocketOS hit a credential mismatch in staging, found an infrastructure token in an unrelated file, and deleted the production database and its volume backups in one API call. Thirty hours down, three months of customer data gone.
Every post-mortem names the same causes: over-privileged tokens in reach of the agent, no gate on destructive actions, backups in the same blast radius. None of them names the model.
Most teams have a line in CLAUDE.md that says "never touch production". That is a sign, not a lock. The agent reads it and usually complies.
What you get
- Audit (evenings 1 to 2): where agents can reach secrets, deploy tooling and git history in your repos and CI.
- Install (evenings 3 to 4): permission rules, PreToolUse and Stop hooks, managed settings, written policy, a real-time alert to your Slack on every blocked action, Cursor rules mirrored. Allow-list, fail-closed: anything not explicitly allowed near protected paths is denied, so tools nobody predicted are covered by construction.
- Proof (evening 5): a test suite committed to your repo and wired into your CI, with a badge. Every block is a runnable assertion. A two-page exposure report with the before/after table, and a one-page mapping of the controls to SOC 2 and ISO 27001 for your next security questionnaire.
- 30 days of tuning when a real workflow trips a rule.
Delivered asynchronously and in writing. One optional call. NDA before any repo access; your clones are deleted from my machine within 30 days.
Proof, not a promise
This is the lab the service is built from. It runs on my machine today:
$ ./tests/run_tests.sh ok guard still blocks without python3 on PATH ok missing policy file fails closed ok malformed policy file fails closed ok interrupted suite leaves config.json intact ... RESULT: 125 passed, 0 failed $ rm -rf protected/secrets.env BLOCKED: 'rm' is not on the read-only allowlist $ cat protected/README.md allowed
The guard started as a deny-list (block rm, mv, rmdir). It was defeated in minutes. Every one of these wrote into the protected tree unimpeded:
| Bypass | How |
|---|---|
| Other verbs | cp, tee, dd, sed -i, install, rsync into the protected path |
| Nested interpreter | sh -c "rm protected/x", perl -e 'unlink ...' |
| Variable indirection | P=protected; rm $P/x |
| Subshell | (cd protected && rm x) |
| Acting flag | find protected -delete |
| Pipeline | ls protected | xargs rm |
| Clobber operator | echo x >| protected/x |
The rule is now inverted: referencing a protected path is denied unless every verb in the command is on a short read-only allow-list. Unknown fails closed. Your install adds your paths, your secrets locations and your git rules (force-push, history rewrite, direct pushes to main) on top of the same mechanism.
Price
$1,200 / ₪4,000
first three clients, then $1,500. Audit, install, tests in CI, policy, report, 30 days tuning.
$2,500 / ₪8,000
up to five repos, org-level managed settings, one policy for all.
$300 to 500 / month
a monthly report of every blocked agent action posted to your Slack, the policy re-proven automatically on every Claude Code release, updates when hook semantics change, onboarding of new engineers, one incident review.
Israeli clients: invoice in ₪, VAT as applicable. Other clients: USD invoice by card, ACH or bank transfer. Guarantee: if the test suite does not pass in your CI, you do not pay.
Who
Daniel Meshulam, Israel. I build production pipelines and agents with Claude Code daily and I run a hooks lab with 125 passing assertions. I am one person: fixed scope, written delivery, no upsell meetings.
Start
Reply with your repo host (GitHub or GitLab), your CI, and which agents your team runs. I answer in writing within 48 hours with a free first review of your current settings.
Email Danielmeshulam791@gmail.com