Rollcage Guard — AI skill for Claude Code

Rollcage Guard

[](https://github.com/nmaties/rollcage-guard/actions/workflows/ci.yml) [](LICENSE)

A free, open-source hook that stops AI coding agents from **reading your secrets**, **leaking keys in commits** and **running destructive commands**. It works with **Claude Code, Codex CLI, Cursor and Gemini CLI**.

$ rollcage-guard install
Claude Code   hook added to ~/.claude/settings.json
Cursor        hook added to ~/.cursor/hooks.json
Gemini CLI    hook added to ~/.gemini/settings.json

$ rollcage-guard explain "cat .env.local"
block: .env.local
Rollcage blocked access to .env.local: it contains secrets the user hasn't shared with coding agents. …

$ rollcage-guard explain "git push --force origin main"
ask: Force push

Agents run as you. They can read every file you can and run every command you can, and it takes one approved prompt for a `cat .env` to send your keys to a model, or for an `rm -rf` on the wrong path to delete your work. Rollcage Guard checks every tool call before it runs, using each agent's own hook system. It runs locally, needs no account and sends nothing anywhere.

What it stops

	Examples	Default
Secret files	.env, .env.local, .envrc, .dev.vars, .npmrc, ~/.ssh, ~/.aws, ~/.kube/config, *.pem, *.key, Rails master.key, *.tfstate, *.tfvars, service-account JSON, wp-config.php… (.env.example and friends are allowed)	block
Environment dumps	env, printenv, export -p, set, echo $OPENAI_API_KEY, ps eww, /proc/*/environ, Keychain password reads	block
Code that reads env vars	python -c 'os.environ', node -e 'process.env', ruby -e, php -r, perl -e, deno eval, awk ENVIRON…	block
Destructive commands	rm -rf ~ / . / *, git clean -f, DROP DATABASE, TRUNCATE,