Why it mattersAn agent that can run `rm -rf` is one bad prompt from a bad day. A gate that refuses the call before it runs is cheaper than a rollback.
An agent that can run rm -rf is one bad prompt from a bad day.
Failproof is an open-source policy engine for AI coding agents. It hooks into twelve agent harnesses and can refuse a tool call before it runs. The repository has 6,613 stars and sits at rank 14 on Trendshift's daily list on 25 October. It was created on 6 April 2026 under an MIT with Commons Clause license.
What it hooks
The supported harnesses split into two groups. Ten are coding CLIs: Claude Code, OpenAI Codex, GitHub Copilot CLI, Cursor Agent CLI, OpenCode, Pi, Factory Droid, Devin CLI, Antigravity CLI, and Goose. Two are chat and assistant gateways: Hermes and OpenClaw. One policy API and one session history cover all twelve. The project is an npm package. It runs locally.
What a policy blocks
The gate runs before the tool call executes. FailproofAI says this is verified on all twelve harnesses. Forty built-in policies come with it. The named ones in the README cover familiar failure modes. Reads of .env files. Repeated tool-call loops. Privilege escalation and sudo. Destructive SQL. Unreviewed Terraform or kubectl. Recursive deletes. git push --force. Direct pushes to main.
Each of those gates the call before it runs. A separate family of sanitize-* policies runs after a tool returns. FailproofAI says that family reports a secret in tool output. It does not keep the secret out of the agent's context. That is a weaker guarantee.
Why a block beats a review
A pull request review catches a bad commit before it lands. It does not catch an autonomous agent that typed kubectl delete at 2am. The way most teams handle this today is a sandbox and a prompt. A sandbox is a wall around the agent. A prompt is a hope.
A policy engine sits inside the agent's tool loop. The decision happens on the machine the agent is running on, with the context the agent is about to use. FailproofAI's block-failproofai-commands policy is on by default and cannot be switched off: the project says an agent that can pause enforcement can switch off every other policy.
What a team adds themselves
A custom policy is a file in .failproofai/policies/. The example in the README refuses writes whose file path contains production. Commit the file and the whole team gets it on the next pull. Packs are typed failproofai policies add <owner>/<repo>.
A policy engine is only as good as the policies it carries. The forty built-ins are a starting point for a coding agent on a developer laptop. A production agent needs policies written against the operation it is allowed to perform. The project is not a replacement for a sandbox. It is the line that catches the one call a sandbox was never told to refuse.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.