Find the right guardrails.
Community-maintained safety profiles for AI agents. Browse, install with one command, and share your own.
The default safety profile. Blocks rm -rf, force push, secret exfiltration, and destructive database commands. Start here.
savants guard install @savants/standard when command contains 'rm -rf /' then block when command contains 'git push --force' then rewrite 'git push --force-with-lease' when command contains 'DROP TABLE' then block when command contains 'DROP DATABASE' then block when file_path contains '.env' then block when command contains 'npm publish' then ask 'Publishing is permanent. Proceed?' when command contains 'chmod 777' then suggest 'Use chmod 755 instead' NixOS-specific guards. Prevents accidental nix-store --delete, protects flake.lock, warns before nixos-rebuild switch on production.
savants guard install @savants/nixos when command contains 'nix-store --delete' then block when command contains 'nixos-rebuild switch' then ask 'Rebuilding system config. Proceed?' when file_path eq 'flake.lock' then ask 'Modifying flake lockfile. Proceed?' AWS production safety. Blocks S3 bucket deletion, prevents IAM policy changes without review, guards CloudFormation stack deletions.
savants guard install @savants/aws-production when command contains 'aws s3 rb' then block when command contains 'aws iam delete' then block when command contains 'aws cloudformation delete-stack' then ask 'Deleting CloudFormation stack. This is irreversible.' when command contains '--no-verify-ssl' then suggest 'Remove --no-verify-ssl for security' Kubernetes cluster safety. Prevents kubectl delete namespace, blocks force scaling to zero, warns on production context switches.
savants guard install @savants/kubernetes when command contains 'kubectl delete namespace' then block when command contains 'kubectl delete ns' then block when command contains 'kubectl scale --replicas=0' then ask 'Scaling to zero replicas. Proceed?' when command contains 'kubectl config use-context' and command contains 'prod' then ask 'Switching to production context.' Database operation guards. Blocks DROP/TRUNCATE in production, requires WHERE clauses on DELETE/UPDATE, prevents schema migrations without backup.
savants guard install @savants/database-safety when command contains 'DROP TABLE' then block when command contains 'TRUNCATE' then block when command contains 'DELETE FROM' and command not_contains 'WHERE' then block when command contains 'UPDATE' and command not_contains 'WHERE' then block when command contains 'migrate' then ask 'Running database migration. Have you backed up?' CI/CD pipeline guards. Prevents force-merging without reviews, blocks deployment to production from non-main branches, guards secrets in logs.
savants guard install @savants/ci-cd-safety when command contains '--no-verify' then suggest 'Remove --no-verify to run pre-commit hooks' when command contains 'git push --force' and command contains 'main' then block when command contains 'git push --force' and command contains 'master' then block Terraform infrastructure guards. Blocks terraform destroy without plan, prevents state manipulation, warns on provider changes.
savants guard install @devops-team/terraform-guard when command contains 'terraform destroy' then ask 'Destroying infrastructure. Have you reviewed the plan?' when command contains 'terraform state rm' then block when command contains 'terraform state mv' then ask 'Moving Terraform state. Proceed carefully.' Prevents secrets from being committed or exposed. Blocks writes to files containing API keys, tokens, passwords, and private keys.
savants guard install @secops/secret-scanner when file_path contains '.env' then block when file_path contains 'credentials' then block when file_path contains 'id_rsa' then block when file_path contains '.pem' then ask 'Writing to a PEM file. Is this intentional?' when command contains 'curl' and command contains 'Authorization' then suggest 'Use environment variables for auth tokens' Docker container safety. Prevents running containers as root, blocks --privileged, warns on host network mode and volume mounts to /.
savants guard install @savants/docker-safety when command contains '--privileged' then block when command contains 'docker run' and command contains '-v /:/' then block when command contains '--network host' then suggest 'Use a dedicated Docker network instead of host mode' Python development guards. Prevents pip install without virtual env, blocks eval() usage, warns on import * patterns.
savants guard install @community/python-best-practices when command contains 'pip install' and command not_contains '--user' and command not_contains 'venv' then suggest 'Use a virtual environment' when command contains 'eval(' then ask 'Using eval() is dangerous. Are you sure?' SOC 2 compliance guard profile. Enforces audit logging, blocks unencrypted data transfers, prevents unauthorized access pattern changes.
savants guard install @enterprise/compliance-soc2 when command contains '--no-log' then block when command contains 'http://' then suggest 'Use https:// for encrypted connections' when file_path contains 'audit' then ask 'Modifying audit configuration. This requires review.' Git workflow safety. Prevents force pushes, blocks commits without messages, warns on large binary commits and history rewrites.
savants guard install @savants/git-hygiene when command contains 'git push --force' then rewrite 'git push --force-with-lease' when command contains 'git reset --hard' then ask 'Hard reset discards all changes. Proceed?' when command contains 'git rebase' and command contains 'main' then ask 'Rebasing onto main. Proceed?' Share your own guardrails
Publish a profile in 30 seconds and let the community benefit from your safety rules.
savants guard share ./my-rules.json --name my-profile