Guard
Know which agents are installed
guard inventory lists installed and observed AI tools from a signed catalog, with approval state and sightings. The sensor reports processes that behave like AI tools but are not in the catalog.
Use case · Rune Gurd + Rune Box
Secure the coding agents on your developers’ laptops.
Terminal and IDE agents run with the developer’s own access. Guard shows which agents are installed, what they touch, and which of their actions need a second look, using activity metadata and hashed paths.
The problem
What goes wrong today
Coding agents such as Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI, Windsurf and Cline run as the developer. They can read source, open .env files and SSH keys, run any shell command and edit their own rules and hook files.
Their safety settings live in user, project and managed settings files. One committed setting or a single command-line flag can switch off approvals or the sandbox for every session that follows. Security teams rarely know which agents are installed at all.
How Runewrd Labs helps
What each product does here, and its status.
Guard
Find risky settings before a session starts
guard scan reads each harness’s settings, rules, memory, skill and hook files and reports bypass or never-ask modes, disabled sandboxes and hooks, and broad allow rules, with the scope that set them and whether the value is effective.
Guard
See credential access as it happens
guard-sensor reports when an AI tool, or any process it started, opens a credential file, runs a credential-retrieval command or captures the screen. Findings carry a hash of the path, never the file contents.
Guard
Check risky actions before they run
Opt-in harness hooks deny credential-file reads and credential commands, block guardrail lowering and droppers, ask before persistence writes and destructive commands, and warn on unpinned global installs, where each harness allows it.
Rune BoxLive
Run an agent CLI in a governed environment
For work that should not touch the laptop at all, Rune Box can place an agent CLI inside an isolated Citadel with its own policy, egress rules, budgets and signed audit trail.
In the evidence
The exact identifiers you will see.
Names as they appear in Runeward Labs findings, rules and commands, so you can match this page to real output.
| Identifier | Source | What it means | Status |
|---|---|---|---|
sensitive_file_opened_by_ai_process | guard-sensor | An AI tool or its child opened a credential-bearing file such as .env, an SSH or GPG key, cloud CLI credentials or kubeconfig. | |
credential_tool_run_by_ai_process | guard-sensor | A descendant ran a credential-retrieval command such as gh auth token or op read. | |
unlisted_ai_tool_observed | guard-sensor | A process outside the catalog opened AI tool configuration or held a connection to an AI provider API. | |
ai_agent_in_host_app | guard-sensor (macOS) | A harness started inside a terminal or editor, which may hold privacy permissions the agent can use. | |
lethal_trifecta | Session rule · hooks and sensor | Untrusted input, then sensitive access, then egress or publish in one session within an hour. The hooks block it. | |
retry_after_block | Session rule · hooks | After a blocked call, the same target is tried another way within 30 minutes. The hooks block it. |
# opt-in hooks for every supported harness found guard hooks install all # read-only report: no network, no file changes guard scan --discover
Honest limitations
What this does not cover yet
A scan finding shows exposure. A sensor or hook finding shows what an agent attempted, or what was blocked. Neither proves a compromise, and a block decision without a report from the enforcing component doesn’t prove the action was stopped.
- Enforcement differs per harness. Codex, Gemini CLI, Windsurf and Cline cannot ask for confirmation from a hook, so “ask” rules only warn there; Cursor’s write tools can only be allowed or blocked.
- Hooks see what the agent asks its tools to do. Files that other programs write, such as a Python script editing CLAUDE.md or a package install script, are not checked before they happen; the sensor sees them afterwards.
- A person can remove Guard’s hooks. Agents that try are blocked, and guard hooks repair restores partial or broken hooks.
- guard scan reads settings files only: command-line flags such as --yolo, editor-internal state and server-delivered settings are not visible to it.
- Live harness validation is partial: Claude Code and the Cursor CLI have been tested live; the other harnesses still need live qualification.
Your agents already have access. Ward off the risks.
Join Guard early access for your team, or run the free local scan today. Agents in automation too? Add the open-source Rune Box.