nah

expensive mistakes stop here

nah is a guard that hooks into your agent, blocks catastrophic actions before they run, and delegates everything else to your runtime.

microsecond verdicts. no LLM. extensible.

curl -fsSL nahguard.ai/install | sh

claude code · codex · pi · opencode · + 10 more+ 12 more

It knows a disaster when it sees one.

nah parses every call into effects and blocks calls that spell disaster. A block tells the agent what was stopped and what to do instead of retrying. When no guard claims a call, nah delegates: your runtime decides, your permissions stay yours.

19 guards — all on by default

execution hijacks — content from outside becoming code: fetched, decoded, or hidden in obfuscated syntax.

secret theft — credentials read, or piped off the machine.

filesystem destruction — the trees you can't rebuild: system, home, raw devices. and fork bombs.

git disasters — history and remotes with no undo.

Deterministic programs, not LLM judges.

Each guard runs as deterministic code, so a verdict lands in microseconds and doesn't drift between runs.

  • no LLM anywhere — one static Rust binary. no tokens, no daemon, no account.
  • on the record — every decision is stored and replayable. structure only, never your command text.
  • open source — the whole policy is MIT-licensed code, and the exact rule that decided your call is in the repo to inspect.

Your agent can't just turn it off.

Step one of any hijack is switching off the alarm. nah refuses every route it can see: guard disables, trust changes, config edits, hook removal, from any tool call.

You can, though. nah nap opens a ten-minute window where your agent may reconfigure nah, with guards still running. Only you can start it, in a real terminal. nah wake ends it early.

Build the guard you're missing.

No catalog covers what's dangerous in your particular stack. Describe the danger to your agent, and it writes a guard that nah runs like a built-in.

  • any language — a guard is any program: nah pipes it each call's effects on stdin, it answers with a verdict.
  • self-teaching — nah docs, then nah guard new <name>; the CLI discloses as you go.
  • trust-gated — a project's guards don't run until a human trusts the repo, and enabling one pins its exact bytes.

Every guard is a switch.

nah tui — browse the catalog, flip a guard, apply. runtimes and the decision log, one screen over. below: a real recording, not an animation.

Try it yourself.

type what your agent might run

try:

microsecond verdicts · 0 tokens, ever · one Rust binary

Built for your agent's worst day.

nah plans for an adversary already inside your session: your own agent with your shell, prompt-injected, confused, or stuck. For machines you can't afford to lose, don't stop at one gate.

your agent's call

blocks known disasters in microseconds
your runtime decides the rest: permissions, auto mode, or yolo
your environment a sandbox, and credentials that can't do more than the task needs

read the threat model

your agent runs

nah docs threat-model

Runs where your agent already runs.

claude code
codex
cursor
cline
copilot
antigravity
kiro
amp
devin
factory droid
opencode
openclaw
hermes
pi

One install command each. Every adapter hooks the runtime's native path and speaks that runtime's own deny format.

Install.

curl -fsSL nahguard.ai/install | sh

then tell your agent to run:

nah docs start

leaving is two commands:

$ nah hook <runtime> uninstall
$ rm "$(which nah)"

Get involved.

File an issue 0 open Star it
Say hello [email protected]