# Rampart

> Open-source firewall for AI agents. Policy engine that audits and controls what OpenClaw, Claude Code, Cursor, Codex, and any AI tool can do on your machine.

- **Type:** MCP server
- **Install:** `agentstack add mcp-peg-rampart`
- **Verified:** Pending review
- **Seller:** [peg](https://agentstack.voostack.com/s/peg)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [peg](https://github.com/peg)
- **Source:** https://github.com/peg/rampart
- **Website:** https://rampart.sh

## Install

```sh
agentstack add mcp-peg-rampart
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Rampart

**A firewall for AI coding agents.**

[](https://go.dev)
[](LICENSE)
[](https://github.com/peg/rampart/actions/workflows/ci.yml)
[](https://github.com/peg/rampart/releases)
[](https://docs.rampart.sh)

---

Claude Code's `--dangerously-skip-permissions` mode, and similar autonomous modes in Cline and Codex, give agents unrestricted shell access. Your agent can read your SSH keys, exfiltrate your `.env`, or `rm -rf /` with no guardrails.

Rampart sits between the agent and your system. Every command, file access, and network request is evaluated against your policy before it executes. Dangerous commands never run.

---

## Install

```bash
# Homebrew (macOS and Linux, recommended)
brew install peg/tap/rampart

# One-line install (no sudo required)
curl -fsSL https://rampart.sh/install | bash

# Go install (requires Go 1.24+)
go install github.com/peg/rampart/cmd/rampart@latest
```

**Windows (PowerShell):**
```powershell
irm https://rampart.sh/install.ps1 | iex
```

After installing, run `rampart quickstart` or follow the setup steps below.

---

## Quick start

Pick your agent and run one command:

```bash
# Claude Code
rampart setup claude-code

# OpenClaw
rampart setup openclaw

# Hermes Agent (experimental)
rampart setup hermes

# Cline
rampart setup cline

# Codex CLI
rampart setup codex

# Any other agent (wraps $SHELL)
rampart wrap -- your-agent
```

That's it. Verify everything is working:

```bash
rampart doctor
```

Then watch your agent in real time:

```bash
rampart watch
```

### Optional persistent local config

If you do not want to keep exporting environment variables, Rampart also supports
`~/.rampart/config.yaml` for local defaults:

```yaml
url: http://127.0.0.1:9090
# serve_url: http://127.0.0.1:9090   # compatibility alias for url
# api: http://127.0.0.1:9091         # optional advanced override for daemon/split-topology API setups
```

| Setting | Use it for | Notes |
| --- | --- | --- |
| `url` | Primary Rampart base URL | Canonical setting for hook/watch/plugin/service-backed flows |
| `serve_url` | Backwards-compatible alias for `url` | Kept for compatibility; prefer `url` in new configs |
| `api` | Optional API base URL override for approval/control commands | Advanced only; usually unnecessary unless you split the API away from the main serve endpoint |

Notes:
- `url` is the main knob; use this unless you have a specific reason not to.
- `api` is **not** the normal setting for `rampart serve`; it is for advanced daemon/split-topology setups.
- Client-side `--api` flags expect an **API base URL** (`http://127.0.0.1:9091`), while daemon/server `--api` flags refer to an **API listen address** (`127.0.0.1:9091`).

Resolution order is: flag → environment → config file → auto-discovered state → default.

Once running, every tool call goes through Rampart's policy engine first:

```
ALLOW 14:23:01  exec  "npm test"                      [allow-dev]
ALLOW 14:23:03  read  ~/project/src/main.go            [default]
DENY  14:23:05  exec  "rm -rf /tmp/*"                  [block-destructive]
LOG   14:23:08  exec  "curl https://api.example.com"   [log-network]
ASK   14:23:10  exec  "kubectl apply -f prod.yaml"     [ask]
DENY  14:23:12  resp  read .env                        [block-credential-leak]
                  -> blocked: response contained AWS_SECRET_ACCESS_KEY
```

---

## How it works

Pattern matching handles 95%+ of decisions in microseconds. The optional [rampart-verify](https://github.com/peg/rampart-verify) sidecar adds LLM-based classification for ambiguous commands. All decisions go to a hash-chained audit trail.

| Agent | Setup command | Integration |
|-------|--------------|-------------|
| **Claude Code** | `rampart setup claude-code` | Native `PreToolUse` hooks via `~/.claude/settings.json` |
| **OpenClaw** | `rampart setup openclaw` | Native plugin + selective native approvals |
| **Hermes Agent** | `rampart setup hermes` | Experimental `pre_tool_call` user plugin |
| **Cline** | `rampart setup cline` | Native hooks via settings |
| **Codex CLI** | `rampart setup codex` | Wrapper that runs Codex through `rampart preload` |
| **Any agent** | `rampart wrap -- ` | Shell wrapping via `$SHELL` |
| **MCP servers** | `rampart mcp -- ` | MCP protocol proxy |
| **System-wide** | `rampart preload -- ` | LD_PRELOAD syscall interception |

Table of Contents

**Getting Started:** [Install](#install) · [Quick start](#quick-start) · [Claude Code](#claude-code) · [OpenClaw](#openclaw) · [Hermes Agent](#hermes-agent-experimental) · [Wrap any agent](#wrap-any-agent)

**Core Features:** [Policies](#writing-policies) · [Approval flow](#approval-flow) · [Audit trail](#audit-trail) · [Live dashboard](#live-dashboard) · [Webhook notifications](#webhook-notifications)

**Advanced:** [LD_PRELOAD](#protect-any-process-ld_preload) · [MCP proxy](#protect-mcp-servers) · [SIEM integration](#siem-integration) · [Webhook actions](#webhook-actions) · [Preflight API](#preflight-api)

**Reference:** [Performance](#performance) · [Security](#security-recommendations) · [OWASP coverage](#owasp-coverage) · [CLI reference](#cli-reference) · [Compatibility](#compatibility) · [Building from source](#building-from-source)

---

## Claude Code

Native integration through Claude Code's hook system. Every Bash command, file read, and write goes through Rampart before execution:

```bash
# Install background service
rampart serve install

# Wire up hooks
rampart setup claude-code
```

Then use Claude Code normally. Rampart runs invisibly in the background.

To remove:
```bash
rampart setup claude-code --remove
```

---

## OpenClaw

Native plugin integration is now the preferred setup on current OpenClaw builds:

```bash
rampart setup openclaw
```

This keeps OpenClaw's native approval UI while letting Rampart decide which commands actually need approval.

`rampart serve` is part of this path. The plugin calls the local Rampart service for policy evaluation, approvals, and audit flow.

### How exec approvals work

Rampart leaves global `tools.exec.ask` set to `"off"`, so routine shell commands do not spam you with approval prompts. When a Rampart policy returns `ask` for a specific exec call, the plugin reissues only that command with `ask: "always"`, which sends it through OpenClaw's native approval card.

In practice, that means:

- safe commands run normally, with no prompt
- denied commands are blocked immediately
- only commands that match a Rampart `ask` rule show an OpenClaw approval card

### What the plugin protects

**1. Native plugin**: evaluates tool calls in `before_tool_call`, blocks deny decisions immediately, and routes selective exec approvals through OpenClaw's native approval UI.

**2. Selective native approvals**: Rampart decides when an exec should require approval, and OpenClaw shows the approval card only for those matched commands.

**3. Bundled policy profile**: installs the OpenClaw-focused policy profile used by the plugin setup.

### Legacy compatibility path

`rampart setup openclaw --patch-tools` still exists as a compatibility option for older setups, but it is no longer the recommended path. It modifies OpenClaw dist files and must be re-applied after upgrades.

Run `rampart doctor` at any time to verify the current OpenClaw integration state.

---

## Hermes Agent (experimental)

Hermes Agent integration uses a user plugin installed into `~/.hermes/plugins/rampart`:

```bash
rampart setup hermes
hermes plugins enable rampart
```

The plugin registers a Hermes `pre_tool_call` hook and sends sanitized tool metadata to Rampart before execution. It defaults to `/v1/preflight/{tool}` so early tests do not create hidden approvals that Hermes cannot resume. `ask` decisions block with an approval-required message until Hermes has a first-class plugin approval/resume flow.

---

## Wrap any agent

For agents without a hook system, `wrap` sets `$SHELL` to a policy-checking shim. Works with any agent that reads `$SHELL` (Aider, OpenCode, Continue, and more):

```bash
rampart wrap -- aider
rampart wrap -- opencode
rampart wrap -- python my_agent.py
```

---

## Protect any process (LD_PRELOAD)

For agents with no hook system and no `$SHELL` support, `preload` intercepts exec-family syscalls at the OS level:

```bash
rampart preload -- codex
rampart preload -- python my_agent.py
rampart preload -- node agent.js

# Monitor mode: log only, no blocking
rampart preload --mode monitor -- risky-tool
```

Intercepts `execve`, `execvp`, `system()`, `popen()`, and `posix_spawn()`. Denied calls return `EPERM`.

**Platform notes:** Works with all dynamically-linked binaries on Linux. Works on macOS with Homebrew/nvm/pyenv binaries; blocked by SIP for `/usr/bin/*` (AI agents don't live there).

---

## Protect MCP servers

Drop-in proxy between your agent and any MCP server:

```bash
rampart mcp -- npx @modelcontextprotocol/server-filesystem /path
```

In your MCP config (Claude Desktop, etc.):

```json
{
  "mcpServers": {
    "filesystem": {
      "command": "rampart",
      "args": ["mcp", "--", "npx", "@modelcontextprotocol/server-filesystem", "."]
    }
  }
}
```

Auto-generate policies from an MCP server's tool list:

```bash
rampart mcp scan -- npx @modelcontextprotocol/server-filesystem .
```

---

## Writing policies

Policies are YAML. Glob matching, hot-reload on file change.

> `rampart setup` creates `~/.rampart/policies/custom.yaml` as a starter template. It's never overwritten by upgrades.

```yaml
version: "1"
default_action: allow

policies:
  - name: block-destructive
    match:
      tool: ["exec"]
    rules:
      - action: deny
        when:
          command_matches: ["rm -rf *", "mkfs.*", "dd if=*", ":(){ :|:& };:"]
        message: "Destructive command blocked"

  - name: block-credential-reads
    priority: 1
    match:
      tool: ["read"]
    rules:
      - action: deny
        when:
          path_matches: ["**/.ssh/id_*", "**/.aws/credentials", "**/.env"]
        message: "Credential access blocked"

  - name: block-exfil
    match:
      tool: ["fetch"]
    rules:
      - action: deny
        when:
          domain_matches: ["*.ngrok-free.app", "*.requestbin.com", "webhook.site"]
        message: "Exfiltration domain blocked"
```

Use `command_contains` for substring matching (case-insensitive):

```yaml
  - name: block-dangerous-substrings
    match:
      tool: ["exec"]
    rules:
      - action: deny
        when:
          command_contains: ["DROP TABLE", "rm -rf"]
        message: "Dangerous substring detected"
```

Use `action: ask` to trigger an approval prompt:

```yaml
  - name: ask-before-sudo
    match:
      agent: ["claude-code"]
      tool: ["exec"]
    rules:
      - action: ask
        when:
          command_contains: ["sudo "]
        message: "This command needs your approval"
```

**No YAML editing required for common cases.** When a command is blocked, Rampart suggests what to run:

```bash
# When "npm install lodash" gets denied:
#   💡 To allow this: rampart allow "npm install *"
rampart allow "npm install *"
#  Rule added; policy reloaded (12 rules active)
```

**Evaluation:** Deny always wins. Lower priority number = evaluated first. Four actions: `deny`, `ask`, `watch`, `allow`.

### Project-local policies

Drop `.rampart/policy.yaml` in any git repo for project-specific rules. Commit it so every team member gets the same rules automatically:

```bash
rampart init --project
```

**Security note:** Set `RAMPART_NO_PROJECT_POLICY=1` to skip project policy loading when working in untrusted repos.

### Built-in profiles

```bash
rampart init --profile standard    # allow-by-default, blocks dangerous commands
rampart init --profile paranoid    # deny-by-default, explicit allowlist
rampart init --profile ci          # strict; all approvals become hard denies
rampart init --profile yolo        # log-only, no blocking
```

---

## Approval flow

For commands that need a human to decide:

```yaml
policies:
  - name: production-deploys
    match:
      tool: ["exec"]
    rules:
      - action: ask
        when:
          command_matches: ["kubectl apply *", "terraform apply *"]
        message: "Production deployment requires approval"
```

How approval reaches you depends on your environment:

| Environment | How you approve |
|-------------|----------------|
| Claude Code | Native approval prompt in the terminal |
| OpenClaw | Native approval card in your connected chat surface |
| Any | `rampart approve ` via CLI, dashboard, or signed URL |

```bash
rampart pending          # What's waiting
rampart approve abc123   # Let it through
rampart deny abc123      # Block it
```

Pending approvals expire after 2 minutes by default (`--approval-timeout` to change).

---

## Audit trail

Every tool call is logged to hash-chained JSONL. Tamper with any record and the chain breaks:

```bash
rampart audit tail --follow    # Stream events
rampart audit verify           # Check chain integrity
rampart audit stats            # Decision breakdown
rampart audit search           # Query by tool, agent, decision, time range
```

---

## Live dashboard

```bash
rampart watch           # TUI: live colored event stream
```

Web dashboard at **http://localhost:9090/dashboard/** when `rampart serve` is running. Three tabs: live stream, history, and a policy REPL to test commands before they run.

---

## Webhook notifications

```yaml
notify:
  url: "https://discord.com/api/webhooks/your/webhook"
  on: ["deny"]

policies:
  # ...
```

Works with Discord webhooks, Slack incoming webhooks, or any HTTP endpoint.

---

## SIEM integration

```bash
# RFC 5424 syslog (Wazuh, QRadar, ArcSight, Sentinel)
rampart serve --syslog localhost:514

# Common Event Format (Splunk, QRadar)
rampart serve --syslog localhost:514 --cef
```

---

## Webhook actions

Delegate allow/deny decisions to an external service:

```yaml
rules:
  - action: webhook
    when:
      command_matches: ['*production*']
    webhook:
      url: 'http://localhost:8090/verify'
      timeout: 5s
      fail_open: true
```

See [rampart-verify](https://github.com/peg/rampart-verify), an optional LLM sidecar for ambiguous commands (~$0.0001/call).

---

## Preflight API

Check if a call would be allowed without executing it:

```bash
curl -s localhost:9090/v1/preflight/exec \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"agent":"a","session":"s","params":{"command":"rm -rf /"}}'
# → {"allowed":false,"decision":"deny","matched_policies":["block-destructive"]}
```

---

## Performance

Policy evaluation in single-digit microseconds:

| Command | Decision | Time |
|---------|----------|------|
| `rm -rf /` | deny | 8µs |
| `sudo reboot` | watch | 6µs |
| `.ssh/id_rsa` read | deny | 3µs |
| `git status` | allow | 4µs |
| `curl ngrok.io` | deny | 3µs |

---

## Security recommendations

**Self-modification protection.** Agents cannot bypass their own policy by running `rampart allow` or `rampart block`. Those commands are blocked when executed by an agent. Policy modifications must be made by a human.

**Don't run your AI agent as root.** Root access defeats user separation. Run agent frameworks as an unprivileged user.

**Run `rampart serve` as a separate user** in production to prevent agents from reading audit logs or modifying policies.

For a full discussion of the threat model, see [`docs/THREAT-MODEL.md`](docs/THREAT-MODEL.md).

---

## OWASP coverage

Rampart maps to the [OWASP Top 10 for Agentic Applications](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/):

| Risk | Coverage |
|------|----------|
| **ASI02: Tool Misuse** | Yes: every tool call is evaluated before execution |
| **ASI05: Unexpected Code Execution** | Yes: pattern matching plus optional LLM verification |
| **ASI08: Data Exfiltration** | Yes: domain blocking and credential response scanning |
| **ASI09: Human-Agent Trust** | Yes: `ask` actions enforce human-in-the-loop |
| **ASI10: Rogue Agents** | Yes: has

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [peg](https://github.com/peg)
- **Source:** [peg/rampart](https://github.com/peg/rampart)
- **License:** Apache-2.0
- **Homepage:** https://rampart.sh

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-peg-rampart
- Seller: https://agentstack.voostack.com/s/peg
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.