nah

expensive mistakes stop here

nah is a guard that hooks into your agent, blocks catastrophic actions before they run, and delegates everything else to your runtime.

microsecond verdicts. no LLM. extensible.

curl -fsSL nahguard.ai/install | sh

claude code · codex · pi · opencode · + 10 more+ 12 more

It knows a disaster when it sees one.

That's because nah doesn't take a command at its word. It parses every call into its effects before anything runs, and blocks the ones that spell disaster. A block tells the agent what was stopped and what to do instead of retrying. When no guard claims a call, nah delegates: your runtime decides, exactly as it does today.

17 guards — all on by default

execution hijacks — content from outside becoming code: fetched, decoded, or hidden in obfuscated syntax.

secret theft — credentials read, or piped off the machine.

filesystem destruction — the trees you can't rebuild: system, home, raw devices. and fork bombs.

git disasters — history and remotes with no undo.

Deterministic programs, not LLM judges.

Each guard runs as code over the call's effects, so a verdict lands in microseconds and doesn't drift between runs.

  • no LLM anywhere — one static Rust binary. no tokens, no daemon, no account.
  • on the record — every decision is stored and replayable. structure only, never your command text.
  • open source — the whole policy is MIT-licensed code, and the exact rule that decided your call is in the repo to inspect.

Your agent can't just turn it off.

Step one of any hijack is switching off the alarm. nah refuses every route it can see:

  • not by command — nah guard disable, trust changes, config edits: refused from any tool call.
  • not by config — no setting anywhere controls self-protection; it's compiled into the binary.
  • not by repo — a project's .nah/project.toml can turn guards on, never off.
  • you can, though — nah nap opens a ten-minute window where your agent is allowed to configure nah for you: add guards, change settings, rewire hooks. An agent can't start the nap; only you can, in a real terminal. nah wake closes it early.

Build the guard you're missing.

No catalog covers what's dangerous in your particular stack. Describe the danger to your agent, and it writes a guard that nah runs like a built-in.

  • any language — a guard is any program: nah pipes it each call's effects on stdin, it answers with a verdict.
  • self-teaching — nah docs, then nah guard new <name>; the CLI discloses as you go.
  • trust-gated — a project's guards don't run until a human trusts the repo, and enabling one pins its exact bytes.
  • off switch included — flip any guard off, TUI or CLI; those calls just go back to your runtime.

Every guard is a switch.

nah tui — browse the catalog, flip a guard, apply. runtimes and the decision log, one screen over. below: a real recording, not an animation.

Try it yourself.

type what your agent might run

try:

microsecond verdicts · 0 tokens, ever · one Rust binary

Built for your agent's worst day.

nah plans for an adversary already inside your session: your own agent with your shell, prompt-injected, confused, or stuck. For machines you can't afford to lose, don't stop at one gate.

your agent's call

blocks known disasters in microseconds
your runtime decides the rest: permissions, auto mode, or yolo
your environment a sandbox, and credentials that can't do more than the task needs

read the threat model

your agent runs

nah docs threat-model

Runs where your agent already runs.

claude code
codex
cursor
cline
copilot
antigravity
kiro
amp
devin
factory droid
opencode
openclaw
hermes
pi

One install command each. Every adapter hooks the runtime's native path, fails closed, and speaks that runtime's own deny format.

Install.

curl -fsSL nahguard.ai/install | sh

then tell your agent to run:

nah docs start

leaving is two commands:

$ nah hook <runtime> uninstall
$ rm "$(which nah)"

Get involved.

File an issue 2 open Star it ★ 459
Say hello [email protected]