Tool Call Guards

Pre-execution AST blast radius auditor for Claude Code CLI. Intercepts bash commands, dangerous file deletions, env leaks, and unexpected AST mutations before local execution.

Automatic API key, SSH credential, and secret redaction proxy for terminal outputs and tool requests.

Zero-trust policy engine and human-in-the-loop escalation guardrail for sensitive terminal commands.

POSIX command sanitizer preventing accidental recursive deletes, fork bombs, and sudo privilege escalation.