CAIN-42 CAIN StudioCODEGUARD: a firewall for what coding agents run
Coding agents run shell commands and write files on real machines. One bad command (from a
prompt injection in a README, an issue, or a dependency) can wipe a home directory, upload .env, or
force-push over main. CODEGUARD checks every pending command and file write before it runs and answers
DENY, ask a person, or allow, deterministically, with a signed receipt.
#8 of the CAIN-42 Top 25 8 gaps found and fixed today engine 1.2.0 live since 2026-11-02 15:31Z (verified on both gateway instances)
dangerous commands caught on today's last blind set (written after the fixes, run once)
everyday commands wrongly stopped on that set
regression tests, all passing
model calls in the decision
Why it matters
Agent permission prompts are easy to click through, and allow-lists match the first word of a command, so
git -c alias.x='!rm -rf ~' x looks like git. CODEGUARD parses the whole command line: pipes, nested
sh -c, eval, here-documents, brace expansion, interpreter one-liners, commands hidden inside
tar, sed, ssh, git and find options, and downloads that
are run later in the same line.
On this site
How it works
Parse, check, decide, sign.
Live demo
Send any command to the live gate.
Evidence
Every blind run, misses included.
Blind set D
All 70 rows, as run.
Verify it yourself
Receipts and the bundle.
Install for Claude Code
A 30-line hook.
API
Routes.
Limits
Honestly.
Use cases
Where it fits.
2026-11-02 upgrade
What we broke and fixed.
FAQ
Questions.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.