Guardrails for AI coding agents

Stop Claude Code, Cursor, and Codex from touching secrets they don't need, and see every attempt.

The problem

AI agents can read anything on your machine, including .env and ~/.aws/credentials. Whatever they read can end up in a prompt to a third-party model.

troopr blocks those reads at the kernel and keeps an audit trail of every attempt, so you always know what each agent tried to access.

More than a .env blocker

troopr is a guardrail layer for every AI agent your team runs. Here's what ships today and what's coming next.

Available

Secret file blocking

.env files, SSH and GPG keys, cloud credentials, kubeconfig, and password vaults are blocked at the kernel. Add your own paths in troopr.yaml.

Works with any agent

Claude Code, Codex, Cursor's CLI, Aider - anything that runs in a terminal runs under troopr.

Log of every attempt

Blocked reads are written to a local JSON log with the agent, the path, and the time.

Nothing leaves the machine

No telemetry and no network calls. Your config and logs stay on your laptop.

Coming next

Network allowlist

Limit which domains an agent can reach, so anything it does read can't be sent somewhere unexpected.

Secret discovery

troopr init scans your project for secret-looking files and suggests rules, instead of relying on fixed patterns.

Live block alerts

See right in your terminal when troopr stops a read, and which rule stopped it.

Linux support

The same guardrails on Linux workstations and CI runners, built on Landlock.

For teams In pilot

Agencies and product teams run AI agents inside codebases full of client secrets. troopr gives you one set of guardrails across every developer and every agent, and proof that they work.

One policy for everyone

Set the policy once and apply it on every developer's machine. Developers can add rules, not remove yours.

Team audit dashboard

See which agents tried to read which secrets, across every machine, with reports you can hand to a SOC 2 auditor.

Export to your security stack

Send block events to Datadog, Splunk, or the SIEM you already use.

Fleet rollout

Deploy through Jamf or Kandji, sign in with SSO, and keep troopr from being switched off.

How it works

Write a config or use defaults

troopr starts from (allow default) and blocks only the paths you deny. A built-in universal denylist covers the usual suspects; add more in troopr.yaml.

# troopr.yaml
version: 1
deny:
  - "**/.env*"
  - "~/.ssh/**"
  - "config/secrets/**"
allow:
  - "**/.env.example"

Run your agent through troopr

troopr compiles the config into an Apple Sandbox Profile (.sb), launches your agent with sandbox-exec, and inherits stdio so the agent works exactly as before.

$ troopr run claude
$ troopr run agent --model auto

Watch denials in real time

When the agent tries to read something off-limits, the kernel denies it and troopr appends a JSON line to ~/.troopr/log.jsonl.

$ tail -f ~/.troopr/log.jsonl
{"timestamp":"2026-05-13T17:30:26Z","agent":"claude","path":"/Users/g/.aws/credentials","action":"deny"}

Universal denylist

Blocked by default on every troopr run. Add more in your troopr.yaml or ~/.troopr/config.yaml.

**/.env**/.env.***/*.pem**/id_rsa***/id_ed25519*~/.ssh/**~/.aws/credentials~/.aws/config~/.gnupg/**~/.kube/config~/.docker/config.json~/.netrc**/secrets/****/*.kdbx**/*.kdb

Install

Requires Go 1.22+ and macOS 13 or newer. The binary is ~5MB with no runtime dependencies.

# clone (private alpha - get in touch for access)
$ git clone git@github.com:paanSinghCoder/troopr.git
$ cd troopr
$ go build -o /usr/local/bin/troopr ./cmd/troopr

# verify
$ troopr version
0.1.0

Try it on a sandbox directory before pointing it at a real project:

$ mkdir /tmp/demo && cd /tmp/demo
$ echo "SECRET=abc" > .env && echo "ok" > public.txt
$ troopr run /bin/cat public.txt
ok
$ troopr run /bin/cat .env
cat: .env: Operation not permitted

FAQs

Does troopr send any data anywhere?

No. troopr has no telemetry and makes no network calls. Its log stays on your machine in ~/.troopr/log.jsonl. Your agent still talks to its own model provider as usual; troopr only limits which files it can touch.

Why not Docker or a VM?

Too much friction. troopr is a single exec wrapper: no daemon, no image, no port forwarding, no volume mounts. The agent reads and writes your real filesystem as it always did, anywhere on the machine. Only the paths you deny are blocked, for both reads and writes.

Why macOS only?

troopr is built on sandbox-exec, which only exists on macOS. Linux support (via Landlock) is planned next. If your team needs it, tell us and it moves up the list.

Is sandbox-exec really deprecated?

Apple has marked it deprecated for years, but it still ships and works in current macOS releases. If Apple removes the command-line tool, troopr can switch to the sandbox API underneath it.

Path-based, not content scanning?

Right. troopr's rules match file paths, not what's inside files. A secret copied into a file that isn't on the deny list can still be read, so add any unusual secret locations to deny.

Is this a hard security boundary?

No. It's defense in depth against mistakes, like an agent reaching for ~/.aws/credentials because a model suggested it. It doesn't stop an agent sending files it can read over the network, and a program deliberately trying to escape the sandbox should be assumed to succeed.