Rampart

Rampart

A firewall for AI coding agents.

[](https://go.dev) [](LICENSE) [](https://github.com/peg/rampart/actions/workflows/ci.yml) [](https://github.com/peg/rampart/releases) [](https://docs.rampart.sh)

---

Claude Code's --dangerously-skip-permissions mode, and similar autonomous modes in Cline and Codex, give agents unrestricted shell access. Your agent can read your SSH keys, exfiltrate your .env, or rm -rf / with no guardrails.

Rampart sits between the agent and your system. Every command, file access, and network request is evaluated against your policy before it executes. Dangerous commands never run.

---

Install

# Homebrew (macOS and Linux, recommended)
brew install peg/tap/rampart

# One-line install (no sudo required)
curl -fsSL https://rampart.sh/install | bash

# Go install (requires Go 1.24+)
go install github.com/peg/rampart/cmd/rampart@latest

Windows (PowerShell):

irm https://rampart.sh/install.ps1 | iex

After installing, run rampart quickstart or follow the setup steps below.

---

Quick start

Pick your agent and run one command:

# Claude Code
rampart setup claude-code

# OpenClaw
rampart setup openclaw

# Hermes Agent (experimental)
rampart setup hermes

# Cline
rampart setup cline

# Codex CLI
rampart setup codex

# Any other agent (wraps $SHELL)
rampart wrap -- your-agent

That's it. Verify everything is working:

rampart doctor

Then watch your agent in real time:

rampart watch

Optional persistent local config

If you do not want to keep exporting environment variables, Rampart also supports ~/.rampart/config.yaml for local defaults:

url: http://127.0.0.1:9090
# serve_url: http://127.0.0.1:9090   # compatibility alias for url
# api: http://127.0.0.1:9091         # optional advanced override for daemon/split-topology API setups

| Setting | Use it for | Notes | | --- | --- | --- | | url | Primary Rampart base URL | Canonical setting for hook/watch/plugin/service-backed flows | | serve_url | Backwards-compatible alias for url | Kept for compatibility; prefer url in new configs | | api | Optional API base URL override for approval/control commands | Advanced only; usually unnecessary unless you split the API away from the main serve endpoint |

Notes:

• url is the main knob; use this unless you have a specific reason not to.
• api is not the normal setting for rampart serve; it is for advanced daemon/split-topology setups.
• Client-side --api flags expect an API base URL (http://127.0.0.1:9091), while daemon/server --api flags refer to an API listen address (127.0.0.1:9091).

Resolution order is: flag → environment → config file → auto-discovered state → default.

Once running, every tool call goes through Rampart's policy engine first:

ALLOW 14:23:01  exec  "npm test"                      [allow-dev]
ALLOW 14:23:03  read  ~/project/src/main.go            [default]
DENY  14:23:05  exec  "rm -rf /tmp/*"                  [block-destructive]
LOG   14:23:08  exec  "curl https://api.example.com"   [log-network]
ASK   14:23:10  exec  "kubectl apply -f prod.yaml"     [ask]
DENY  14:23:12  resp  read .env                        [block-credential-leak]
                  -> blocked: response contained AWS_SECRET_ACCESS_KEY

---

How it works

Pattern matching handles 95%+ of decisions in microseconds. The optional rampart-verify sidecar adds LLM-based classification for ambiguous commands. All decisions go to a hash-chained audit trail.

| Agent | Setup command | Integration | |-------|--------------|-------------| | Claude Code | rampart setup claude-code | Native PreToolUse hooks via ~/.claude/settings.json | | OpenClaw | rampart setup openclaw | Native plugin + selective native approvals | | Hermes Agent | rampart setup hermes | Experimental pre_tool_call user plugin | | Cline | rampart setup cline | Native hooks via settings | | Codex CLI | rampart setup codex | Wrapper that runs Codex through rampart preload | | Any agent | rampart wrap -- | Shell wrapping via $SHELL | | MCP servers | rampart mcp -- | MCP protocol proxy | | System-wide | rampart preload -- | LD_PRELOAD syscall interception |

Table of Contents

Getting Started: [Install](#install) · [Quick start](#quick-start) · [Claude Code](#claude-code) · [OpenClaw](#openclaw) · [Hermes Agent](#hermes-agent-experimental) · [Wrap any agent](#wrap-any-agent)

Core Features: [Policies](#writing-policies) · [Approval flow](#approval-flow) · [Audit trail](#audit-trail) · [Live dashboard](#live-dashboard) · [Webhook notifications](#webhook-notifications)

Advanced: [LDPRELOAD](#protect-any-process-ldpreload) · [MCP proxy](#protect-mcp-servers) · [SIEM integration](#siem-integration) · [Webhook actions](#webhook-actions) · [Preflight API](#preflight-api)

Reference: [Performance](#performance) · [Security](#security-recommendations) · [OWASP coverage](#owasp-coverage) · [CLI reference](#cli-reference) · [Compatibility](#compatibility) · [Building from source](#building-from-source)

---

Claude Code

Native integration through Claude Code's hook system. Every Bash command, file read, and write goes through Rampart before execution:

# Install background service
rampart serve install

# Wire up hooks
rampart setup claude-code

Then use Claude Code normally. Rampart runs invisibly in the background.

To remove:

rampart setup claude-code --remove

---

OpenClaw

Native plugin integration is now the preferred setup on current OpenClaw builds:

rampart setup openclaw

This keeps OpenClaw's native approval UI while letting Rampart decide which commands actually need approval.

rampart serve is part of this path. The plugin calls the local Rampart service for policy evaluation, approvals, and audit flow.

How exec approvals work

Rampart leaves global tools.exec.ask set to "off", so routine shell commands do not spam you with approval prompts. When a Rampart policy returns ask for a specific exec call, the plugin reissues only that command with ask: "always", which sends it through OpenClaw's native approval card.

In practice, that means:

• safe commands run normally, with no prompt
• denied commands are blocked immediately
• only commands that match a Rampart ask rule show an OpenClaw approval card

What the plugin protects

1. Native plugin: evaluates tool calls in before_tool_call, blocks deny decisions immediately, and routes selective exec approvals through OpenClaw's native approval UI.

2. Selective native approvals: Rampart decides when an exec should require approval, and OpenClaw shows the approval card only for those matched commands.

3. Bundled policy profile: installs the OpenClaw-focused policy profile used by the plugin setup.

Legacy compatibility path

rampart setup openclaw --patch-tools still exists as a compatibility option for older setups, but it is no longer the recommended path. It modifies OpenClaw dist files and must be re-applied after upgrades.

Run rampart doctor at any time to verify the current OpenClaw integration state.

---

Hermes Agent (experimental)

Hermes Agent integration uses a user plugin installed into ~/.hermes/plugins/rampart:

rampart setup hermes
hermes plugins enable rampart

The plugin registers a Hermes pre_tool_call hook and sends sanitized tool metadata to Rampart before execution. It defaults to /v1/preflight/{tool} so early tests do not create hidden approvals that Hermes cannot resume. ask decisions block with an approval-required message until Hermes has a first-class plugin approval/resume flow.

---

Wrap any agent

For agents without a hook system, wrap sets $SHELL to a policy-checking shim. Works with any agent that reads $SHELL (Aider, OpenCode, Continue, and more):

rampart wrap -- aider
rampart wrap -- opencode
rampart wrap -- python my_agent.py

---

Protect any process (LD_PRELOAD)

For agents with no hook system and no $SHELL support, preload intercepts exec-family syscalls at the OS level:

rampart preload -- codex
rampart preload -- python my_agent.py
rampart preload -- node agent.js

# Monitor mode: log only, no blocking
rampart preload --mode monitor -- risky-tool

Intercepts execve, execvp, system(), popen(), and posix_spawn(). Denied calls return EPERM.

Platform notes: Works with all dynamically-linked binaries on Linux. Works on macOS with Homebrew/nvm/pyenv binaries; blocked by SIP for /usr/bin/* (AI agents don't live there).

---

Protect MCP servers

Drop-in proxy between your agent and any MCP server:

rampart mcp -- npx @modelcontextprotocol/server-filesystem /path

In your MCP config (Claude Desktop, etc.):

{
  "mcpServers": {
    "filesystem": {
      "command": "rampart",
      "args": ["mcp", "--", "npx", "@modelcontextprotocol/server-filesystem", "."]
    }
  }
}

Auto-generate policies from an MCP server's tool list:

rampart mcp scan -- npx @modelcontextprotocol/server-filesystem .

---

Writing policies

Policies are YAML. Glob matching, hot-reload on file change.

> rampart setup creates ~/.rampart/policies/custom.yaml as a starter template. It's never overwritten by upgrades.

version: "1"
default_action: allow

policies:
  - name: block-destructive
    match:
      tool: ["exec"]
    rules:
      - action: deny
        when:
          command_matches: ["rm -rf *", "mkfs.*", "dd if=*", ":(){ :|:& };:"]
        message: "Destructive command blocked"

  - name: block-credential-reads
    priority: 1
    match:
      tool: ["read"]
    rules:
      - action: deny
        when:
          path_matches: ["**/.ssh/id_*", "**/.aws/credentials", "**/.env"]
        message: "Credential access blocked"

  - name: block-exfil
    match:
      tool: ["fetch"]
    rules:
      - action: deny
        when:
          domain_matches: ["*.ngrok-free.app", "*.requestbin.com", "webhook.site"]
        message: "Exfiltration domain blocked"

Use command_contains for substring matching (case-insensitive):

  - name: block-dangerous-substrings
    match:
      tool: ["exec"]
    rules:
      - action: deny
        when:
          command_contains: ["DROP TABLE", "rm -rf"]
        message: "Dangerous substring detected"

Use action: ask to trigger an approval prompt:

  - name: ask-before-sudo
    match:
      agent: ["claude-code"]
      tool: ["exec"]
    rules:
      - action: ask
        when:
          command_contains: ["sudo "]
        message: "This command needs your approval"

No YAML editing required for common cases. When a command is blocked, Rampart suggests what to run:

# When "npm install lodash" gets denied:
#   💡 To allow this: rampart allow "npm install *"
rampart allow "npm install *"
#  Rule added; policy reloaded (12 rules active)

Evaluation: Deny always wins. Lower priority number = evaluated first. Four actions: deny, ask, watch, allow.

Project-local policies

Drop .rampart/policy.yaml in any git repo for project-specific rules. Commit it so every team member gets the same rules automatically:

rampart init --project

Security note: Set RAMPART_NO_PROJECT_POLICY=1 to skip project policy loading when working in untrusted repos.

Built-in profiles

rampart init --profile standard    # allow-by-default, blocks dangerous commands
rampart init --profile paranoid    # deny-by-default, explicit allowlist
rampart init --profile ci          # strict; all approvals become hard denies
rampart init --profile yolo        # log-only, no blocking

---

Approval flow

For commands that need a human to decide:

policies:
  - name: production-deploys
    match:
      tool: ["exec"]
    rules:
      - action: ask
        when:
          command_matches: ["kubectl apply *", "terraform apply *"]
        message: "Production deployment requires approval"

How approval reaches you depends on your environment:

| Environment | How you approve | |-------------|----------------| | Claude Code | Native approval prompt in the terminal | | OpenClaw | Native approval card in your connected chat surface | | Any | rampart approve via CLI, dashboard, or signed URL |

rampart pending          # What's waiting
rampart approve abc123   # Let it through
rampart deny abc123      # Block it

Pending approvals expire after 2 minutes by default (--approval-timeout to change).

---

Audit trail

Every tool call is logged to hash-chained JSONL. Tamper with any record and the chain breaks:

rampart audit tail --follow    # Stream events
rampart audit verify           # Check chain integrity
rampart audit stats            # Decision breakdown
rampart audit search           # Query by tool, agent, decision, time range

---

Live dashboard

rampart watch           # TUI: live colored event stream

Web dashboard at http://localhost:9090/dashboard/ when rampart serve is running. Three tabs: live stream, history, and a policy REPL to test commands before they run.

---

Webhook notifications

notify:
  url: "https://discord.com/api/webhooks/your/webhook"
  on: ["deny"]

policies:
  # ...

Works with Discord webhooks, Slack incoming webhooks, or any HTTP endpoint.

---

SIEM integration

# RFC 5424 syslog (Wazuh, QRadar, ArcSight, Sentinel)
rampart serve --syslog localhost:514

# Common Event Format (Splunk, QRadar)
rampart serve --syslog localhost:514 --cef

---

Webhook actions

Delegate allow/deny decisions to an external service:

rules:
  - action: webhook
    when:
      command_matches: ['*production*']
    webhook:
      url: 'http://localhost:8090/verify'
      timeout: 5s
      fail_open: true

See rampart-verify, an optional LLM sidecar for ambiguous commands (~$0.0001/call).

---

Preflight API

Check if a call would be allowed without executing it:

curl -s localhost:9090/v1/preflight/exec \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"agent":"a","session":"s","params":{"command":"rm -rf /"}}'
# → {"allowed":false,"decision":"deny","matched_policies":["block-destructive"]}

---

Performance

Policy evaluation in single-digit microseconds:

| Command | Decision | Time | |---------|----------|------| | rm -rf / | deny | 8µs | | sudo reboot | watch | 6µs | | .ssh/id_rsa read | deny | 3µs | | git status | allow | 4µs | | curl ngrok.io | deny | 3µs |

---

Security recommendations

Self-modification protection. Agents cannot bypass their own policy by running rampart allow or rampart block. Those commands are blocked when executed by an agent. Policy modifications must be made by a human.

Don't run your AI agent as root. Root access defeats user separation. Run agent frameworks as an unprivileged user.

Run rampart serve as a separate user in production to prevent agents from reading audit logs or modifying policies.

For a full discussion of the threat model, see [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).

---

OWASP coverage

Rampart maps to the OWASP Top 10 for Agentic Applications:

| Risk | Coverage | |------|----------| | ASI02: Tool Misuse | Yes: every tool call is evaluated before execution | | ASI05: Unexpected Code Execution | Yes: pattern matching plus optional LLM verification | | ASI08: Data Exfiltration | Yes: domain blocking and credential response scanning | | ASI09: Human-Agent Trust | Yes: ask actions enforce human-in-the-loop | | ASI10: Rogue Agents | Yes: has

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: peg
• Source: peg/rampart
• License: Apache-2.0
• Homepage: https://rampart.sh

Install and usage instructions live in the source repository linked above.