Nah
by Manuel Schipper (independent open-source project)
Deterministic guard that blocks catastrophic coding-agent actions
nah is a deterministic permission guard for coding agents. It hooks into Claude Code, Cursor, Codex, Copilot and around ten other agents, classifies each proposed tool call by what the command actually does rather than which binary it names, and blocks the ones that would destroy files, leak secrets or rewrite git history.
nah is an open-source guard that sits between a coding agent and the operating system, blocking catastrophic tool calls before they execute. It installs as a pre-tool-use hook — the project lists integrations for roughly a dozen agents including Claude Code, Codex, Cursor, Cline, Copilot, Devin and OpenCode — and evaluates every proposed action through a four-stage pipeline: parse the call into typed effects (programs, file operations, network activity), resolve paths and variables against the actual machine state, test the result against 19 built-in guards, and return either a block or a delegate verdict. The classification is deliberately deterministic; as the documentation puts it, a verdict needs no LLM, so decisions land in microseconds, cost no tokens and repeat identically across runs, with optional escalation to a model reserved for genuinely ambiguous calls. The guards cover four failure classes the author treats as catastrophic: execution hijacks, secret theft, filesystem destruction and git history disasters — the canonical example being that rm dist/bundle.js and rm ~/.bashrc are the same command to an allow/deny list and different actions to nah. Version 1.0 is a ground-up Rust rewrite of the original stdlib-only Python implementation that reached Hacker News in March 2026 with 127 points and 94 comments; it ships as one static binary installed by a single curl command, with per-project guard extensions that must be explicitly trusted via nah trust so an untrusted repository cannot widen its own permissions. MIT licensed, 461 GitHub stars, macOS and Linux only.
The engineering lead whose developers run coding agents directly on real laptops without a sandbox, and who needs a deterministic, auditable block on the small set of actions that are genuinely unrecoverable.
Catastrophic agent actions — an rm on a home directory, a force-push over main, a .env read piped outbound — are refused in microseconds, with no model in the loop and no token cost.
At a Glance
- Category
- Governance & Security
- Pricing
- Free
- Target Market
- CTOs, Enterprise Developers, Security Engineers, Platform Engineers
- Deployment
- Open-source, Self-hosted
- Founded
- 2026
Key Features
- ✓Intent-based classifier
Parses each tool call into typed effects and judges what the command actually does, not which binary it happens to name.
- ✓19 built-in guards
Shipped rules covering execution hijacks, secret theft, filesystem destruction and git history rewrites, each individually toggleable via TUI or CLI.
- ✓Deterministic, LLM-free verdicts
Decisions arrive in microseconds, consume no tokens and repeat identically across runs, so the policy is auditable and testable.
- ✓Hooks into 13+ agents
Installs as a pre-tool-use hook for Claude Code, Codex, Cursor, Cline, Copilot, Devin and OpenCode.
- ✓Custom guards with explicit trust
Any standalone program can act as a guard, and project-level extensions require an explicit nah trust before they are allowed to run.
- ✓Single static Rust binary
One curl command installs it, with no daemon, no account, no API key and no runtime dependencies.
- ✓Fail-closed mode
The --fail-closed flag denies any call whose safety evaluation cannot complete, trading convenience for a safer default.
Use Cases
- •Running an agent without --dangerously-skip-permissions
Gives a coding agent room to work while still hard-blocking the handful of actions that cause unrecoverable damage.
- •Protecting developer laptops from accidental agent damage
Catches the rm, git reset --hard and force-push classes of mistake before they ever reach the working tree.
- •Layered defence alongside containers
Runs inside a Docker container or VM as a second control, since isolation and policy fail in genuinely different ways.
- •Blocking credential exfiltration paths
Guards flag reads of .env files and outbound network calls that would carry secrets off the machine.
- •Enforcing repo-specific policy in shared codebases
Global configuration can only be tightened by a project, so an untrusted repository cannot self-grant wider permissions.
Ideal For
Best For
- ✓Developers running coding agents on their own machine without a container or VM
- ✓Platform teams standardising agent permissions across an engineering organisation
- ✓Anyone tempted to reach for --dangerously-skip-permissions to escape approval fatigue
- ✓Security engineers who need agent policy decisions to be deterministic and replayable
- ✓Open-source-first teams unwilling to send tool calls to a third-party service for judgement
Not Ideal For
- ✗Anyone whose threat model is a genuinely malicious agent — Hacker News commenters demonstrated working escapes via PAGER='/bin/sh -c ...' git help and git difftool -x, and the author positions nah as catching roughly 95% of accidental damage rather than defeating an adversary
- ✗Windows users: there is no native Windows build, only macOS and Linux
- ✗Teams that already run every agent inside a disposable container or VM, where real isolation makes a policy layer largely redundant
- ✗CI pipelines that pass --dangerously-skip-permissions, since that flag makes Claude Code fire PreToolUse hooks asynchronously and commands can execute before nah returns a verdict
Deployment
Market Analysis
Pros
- ✓Deterministic and free: microsecond verdicts, no tokens, no account, MIT licence
- ✓Context-aware in a way allow/deny lists are not — the same binary gets a different verdict depending on its arguments and resolved paths
- ✓Unusually honest positioning: the author publicly acknowledged bypasses and the sandboxing-is-better argument in the Hacker News thread
- ✓Single static binary with no daemon or dependencies, so it is trivial to add and trivial to remove
Cons
- ✗Blacklist-shaped by design; Hacker News commenters demonstrated working escapes through environment variables and git's external-tool hooks
- ✗Some users reported excessive prompts on obviously safe commands such as piped grep and find
- ✗It can only block or delegate, never approve, so it does not remove the approval prompt entirely
- ✗Multi-step exfiltration chains (read .env, write a script, run the script) look legitimate action by action
- ✗No native Windows support, and the hook is bypassed when Claude Code runs with --dangerously-skip-permissions, which is common in CI
Pricing
Open source (MIT)
$0
- ✓Single static Rust binary
- ✓19 built-in guards
- ✓Hooks for 13+ coding agents
- ✓Custom guard extensions
- ✓TUI and CLI guard management
Entirely free and MIT-licensed: one curl install, no account, no API key and no tokens consumed, and there is no paid tier, hosted service or enterprise edition on offer.
Security & Compliance
Connect
Sources
This page was written from 5 sources, 4 on domains other than nahguard.ai.
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
OpenAI Daybreak
Vetted-access frontier AI for cyber defenders, with a purpose-built offensive-security model
NVIDIA OpenShell
Open-source, kernel-isolated sandbox runtime for autonomous AI agents
Zenity
Runtime AI agent security that blocks a harmful agent action before it executes
Saviynt Zuma
Identity control plane for AI agents and non-human identities, with runtime authorization