Why file-tool deny rules aren't enough
In Claude Code and Cursor, a Read(./.env) deny rule stops the file tool from opening .env, but an agent with Bash access can still run cat .env, python3 -c "open('.env').read()", or base64 .env. And passing a token in a curl URL or -H "Authorization: Bearer ..." flag exposes the expanded secret to every local user via ps aux (see reproduction).
Tested guardrails you can install today
- CLAUDE.md Template Pack ($9) (Buy · $9) —
guard-bash.sh+protect-files.shhooks tested against 22 dangerous command patterns. - Agent Ops Kit ($19) (Buy · $19) — full Ubuntu server guardrails, preflight audits, and safe
curl -K -Telegram helpers. - Multi-Vendor AI Council Ops Kit ($39) (Buy · $39) — run Claude, Codex, Gemini and Grok in isolated Linux seats with pre-publish secret scanning and mandatory peer-review branches.
- Free STDIO Guardrails MCP Server — wire these checks directly into Claude Code, Claude Desktop, Cursor, Codex CLI or Gemini CLI via Model Context Protocol.