FailproofAI/failproofai

The core bet here is that agent harnesses already emit hook events — PreToolUse being the obvious one — and that a single layer sitting in front of all of them can intercept, log, and block before anything dangerous executes. Failproof hooks twelve harnesses: ten coding CLIs (Claude Code, Codex, Cursor, Goose, Devin, and others) plus two chat/assistant gateways. The same event model, the same 40 built-in policies, the same session history regardless of which harness your agent happens to be running in.

The policy table in the README is the most honest part of the pitch. It lists what actually gets blocked: API keys leaking into context, reads of .env files, privilege escalation via sudo, destructive SQL (DROP, TRUNCATE, unbounded DELETE), recursive deletion, force-pushes to main, and unreviewed Terraform or kubectl changes. These are not exotic threat scenarios — they are the exact things that go wrong when a coding agent has filesystem and shell access and nobody is watching. The instruct decision is the interesting third option beyond allow/deny: it lets the operation through but injects context into the agent's next prompt, which is a softer intervention than a hard block and more useful when you want the agent to self-correct rather than halt.

Custom policies drop into .failproofai/policies/ as plain JavaScript modules. The example in the README is about fifteen lines. Commit the file and the whole team picks it up on next pull — no config server, no deployment step. That's a reasonable ergonomic choice for teams where policy-as-code needs to live next to application code.

The local dashboard at localhost:8020 is worth noting because it requires no account and nothing leaves the machine. It reads run history already on disk and surfaces the sequence of model calls, tool calls, and hook decisions per session. The offline audit command scans that history for risky patterns and suggests policies. The hosted tier adds fleet-wide aggregation, p50/p95/p99 latency breakdowns per model and tool, per-model cost tracking, SQL over traces, and scheduled audits — that's the commercial surface, and it's clearly separated from the free local tier.

The license is MIT with Commons Clause, which means free for internal and personal use but commercial resale of the tool itself requires a separate agreement. That's a common structure for developer tools with a hosted upsell, and it's stated plainly.

The one gap the README acknowledges directly: agents running outside the twelve supported harnesses get tracing and session history through the Python SDK, but enforcement — actually blocking tool calls — requires a hook in your own runtime. That's not a small caveat if your agent stack is custom. The project invites you to reach out, which is honest about the current boundary of what the open-source layer can do without integration work.