Policy gate for agent side effects
mayrun
Agents don’t run dangerous commands until mayrun says they may.
Primary path: eval "$(mayrun shell-hook)" — local shell gate, not
another dashboard.
-
$mayrun check 'rm -rf /'Deny -
$mayrun run 'git push'Require approval -
$mayrun run 'cargo test'Allow
How it works
Local-first choke point on the write path — shell-hook, MCP, or CLI — not a dashboard that watches after the damage.
- Decide Repo YAML packs and rules. Deny, require approval, or allow — deterministic only. AI never grants Allow.
- Prove Hash-chained receipts with
rule_id/ reason. Same gate across Cursor, Claude, OpenCode, and raw shell. - Confine Optional local sandbox under Allow. Complements vendor permissions and org platforms; does not replace them.
Built for real agent mishaps
Business cases from the write path — not governance theater.
-
Stop destructive agent shell
Deny rm -rf, mkfs, curl|sh, force-push, and sudo before the agent finishes the sentence.
dangerous-defaults -
Human gate for push and publish
Require a human --approve before git push, cargo publish, or npm publish.
git-safe -
Secret and credential hygiene
Deny ssh/aws/gnupg exfil paths; require approval to read project .env files.
secrets-safe -
Plan-mode / read-only agents
Inspection-only allowlist for agents that should look, not mutate.
read-only -
Ops mutations need a human
terraform apply, kubectl apply, and docker push require approval before they run.
ops-approve -
Gate high-risk MCP upstreams
Put mcp-proxy in front of filesystem or shell MCPs and evaluate tools/call.
mcp-safe
Install
Single Rust binary. Shell-hook first; MCP optional for Cursor / Claude / OpenCode.
cargo install --git https://github.com/kiket-dev/mayrun --locked
mayrun init --detect
eval "$(mayrun shell-hook)"
rm -rf / # Deny + rule_idmayrun init --detect
mayrun check 'rm -rf /' # Deny
mayrun run 'git status' # Allow → execute