ai-runtime-guard
Your agent can say anything. It can only do what policy allows.
AI agents with filesystem and shell access can delete files, leak credentials, or execute destructive commands, often without the user realizing until it is too late.
Runtime Guard sits between your AI agent and your system, enforcing policy on every file and shell action before it executes. Install once, configure your rules, and your agent operates within the boundaries you set. Works with Claude Code, Claude Desktop, Cursor, Codex, and any MCP-compatible client. No retraining, no prompt engineering, no external account required.
See it in action
agent -> execute_command("rm -rf /tmp/build")
✗ BLOCKED destructive command pattern: rm -rf
matched_rule: destructive_command | decision: blocked
agent -> execute_command("git push --force")
⏸ APPROVAL REQUIRED awaiting operator
token: a4f2b9 | expires: 10min | check GUI to approve
agent -> write_file("README.md", ...)
✓ ALLOWED backup created before write
backup_location: ~/.local/state/airg/backups/2026-03-18
