Share Guard Profiles

Name: Savants
Author: Savants

Create reusable guardrails, share them with a single command, and let others install with one line. Semver ensures updates never surprise you.

Three ways to share:

Cloud — savants guard share → anyone installs with @you/profile-name
URL — host a JSON file anywhere, install from any URL
Community — open a PR to the savants repo for curated profiles

Create a Profile

A guard profile is a JSON array of DSL rules. Create one in ~/.savants/custom-profiles/:

mkdir -p ~/.savants/custom-profiles

cat > ~/.savants/custom-profiles/my-team-rules.json << 'EOF'
[
  "when tool eq 'Bash' and command contains 'rm -rf /' then block",
  "when tool eq 'Bash' and command contains 'DROP TABLE' then block",
  "when tool eq 'Bash' and command contains 'force push' then ask 'Are you sure?'",
  "when tool eq 'Write' and file_path contains '.env' then block"
]
EOF

Activate it locally:

savants guard preset standard+my-team-rules

Share to the Cloud

One command publishes your profile so anyone can install it:

# First time: connect your account
savants connect

# Share your profile
savants guard share my-team-rules --version 1.0.0

# Output:
# Shared! Install with: savants guard install @yourname/my-team-rules

Publish updates with bumped versions:

# Added new rules (minor bump)
savants guard share my-team-rules --version 1.1.0

# Changed suggest to block (major bump — breaking)
savants guard share my-team-rules --version 2.0.0

Install a Profile

# Install latest version
savants guard install @alice/aws-safe

# Pin to exact version
savants guard install @alice/aws-safe@1.2.0

# Pin to major (auto-update patches & minors)
savants guard install @alice/aws-safe@^1

# Pin to minor (auto-update patches only)
savants guard install @alice/aws-safe@~1.2

# Install from a URL
savants guard install https://gist.githubusercontent.com/.../rules.json

# Install a built-in community profile
savants guard install nixos-safe

Then activate it alongside your existing preset:

savants guard preset standard+aws-safe

Versioning (Semver)

Guard profiles follow semantic versioning so updates never surprise you:

Bump	Example	What changed	Auto-updates?
Patch	1.0.0 → 1.0.1	Wording changes, no behavior change	Yes
Minor	1.0.0 → 1.1.0	New rules added, existing rules unchanged	Yes (with `^1`)
Major	1.0.0 → 2.0.0	Rules removed, actions changed (suggest → block)	Never

Why this matters: If a profile author changes a suggest to a block, your agent could suddenly stop mid-task. Major version bumps require you to explicitly opt in.

Auto-Updates

By default, profiles auto-update within their pinned range once per day. No performance impact — it's a single cached HTTP check.

# Check what would update (dry run)
savants guard update --check

# Update all profiles now
savants guard update

# Update one profile
savants guard update aws-safe

# Disable auto-updates globally
savants guard config auto-update off

# Pin to exact version (never auto-updates)
savants guard pin aws-safe 1.2.0

When a new major version is available, you'll see a notice:

i @alice/aws-safe v2.0.0 available (you're on v1.3.1)
  Breaking: 3 rules changed from suggest to block
  Run: savants guard update aws-safe --major

Rollback

If a profile update breaks your workflow:

# Roll back to the previous version
savants guard rollback aws-safe
# Rolled back @alice/aws-safe: v1.3.1 → v1.2.0

# See all available versions
savants guard versions @alice/aws-safe
# v1.3.1  2026-07-05  28 rules  (previous)
# v1.2.0  2026-06-28  25 rules  (current)
# v1.1.0  2026-06-20  22 rules
# v1.0.0  2026-06-01  18 rules

The Lock File

Installed profiles are tracked in ~/.savants/profiles.lock:

{
  "@alice/aws-safe": {
    "version": "1.2.0",
    "pinned": "^1",
    "auto_update": true,
    "installed": "2026-07-05",
    "previous": "1.1.0"
  },
  "@miguel/nixos-flake-only": {
    "version": "1.0.0",
    "pinned": "1.0.0",
    "auto_update": false,
    "installed": "2026-07-05"
  }
}

Commit this file to your repo to share the same profile versions across your team.

Browse Popular Profiles

savants guard browse

# Popular Guard Profiles
#
# @savants/battle-tested    v1.0.0   218 rules  12.4K installs
#   Real-world incident rules from OWASP + 26 documented AI agent failures
#
# @savants/credentials-safe v1.2.0    34 rules   8.1K installs
#   Block .env access, credential logging, secret exposure
#
# @alice/aws-safe           v2.1.0    41 rules   3.2K installs
#   Prevent accidental AWS resource deletion, force --dry-run
#
# @miguel/nixos-flake-only  v1.0.0     3 rules     89 installs
#   Enforce flake-only NixOS commands

Contribute a Community Profile

Community profiles ship with Savants and don't require a cloud account to use. To add one:

Create a JSON file with your rules
Name it descriptively: tool-safe.json or workflow-safe.json
Open a PR to packages/guard-profiles/community/ in the savants repo

Community vs Cloud: Community profiles are bundled in the binary — always available offline. Cloud profiles (@user/name) require internet on first install but are cached locally after.

Example: Team Onboarding

Share your team's guardrails in your repo README:

# Install Savants + team guardrails
curl -fsSL savants.sh | sh
savants guard install @acme/backend-safe@^2
savants guard preset standard+backend-safe

# Done. Every developer on the team now has the same safety rules.

Three lines in your README. New developers get the same guardrails as everyone else, automatically kept in sync.

Sync Across Machines

Keep your guard rules in sync across all your machines using savants guard sync:

# Push your current rules to the cloud
savants guard sync push

# Pull the latest rules onto another machine
savants guard sync pull

# Check sync status
savants guard sync status

Auto-sync: Guard rules automatically sync every 5 minutes when a hook is invoked. You only need manual push/pull for immediate sync or initial setup on a new machine.

This is separate from profile sharing. sync keeps your personal rule set (including custom rules and preset selections) identical across your laptop, desktop, and CI environments.