Start
nah must be installed in the same execution environment as the coding agent or agent gateway whose tool calls it evaluates.
nah supports macOS and Linux. Native Windows is not supported.
Install
curl -fsSL https://nahguard.ai/install | sh
nah docs
Inspect guards without installing a hook
nah test runs the real decision pipeline without executing the command:
nah test "git status"
nah test "git reset --hard"
nah guards
A completed decision has two verdicts. A block names the guard that fired. A
delegate leaves the choice to the agent runtime's normal approval or sandbox
path. An evaluation failure does not block by itself; other guards still
decide when evaluation can continue. Matching active custom guards run even
though the tested command does not. nah never approves a call.
Connect one coding agent
Choose a supported runtime:
nah docs runtimes
nah hook codex install
nah hook codex status
nah docs runtime-codex
Restart or reload the runtime and complete any runtime-owned trust step. Hook loading is not something nah can force, so inspect the active integration using the runtime's own interface after installation.
Current installers create user-scoped wiring. While loaded, nah blocks
recognized in-session attempts to alter or bypass it, but the installation is
not tamper-proof against the same operating-system user or changes outside
intercepted tool calls. Read nah docs threat-model for the full boundary.
Understand a decision
Every live decision receives an id. When its redacted audit record is persisted, inspect it with:
nah log
nah why <id>
Configure or extend
nah docs configurationexplains built-in guards and project trust.nah docs extendingbuilds a custom guard.nah docs securitystates the enforcement boundaries.