Rampart

What it does

AI agents call tools — exec, read, write, fetch, MCP. Rampart sits between the agent and those calls, evaluates them against your policies, and blocks what shouldn't run.

Traditional sandboxing is all-or-nothing. Rampart gives you granular control: allow git push, deny rm -rf /, log every curl for review. Per tool, per pattern, with a hash-chained audit trail.

Install

Requires Go 1.24+.

go install github.com/peg/rampart/cmd/rampart@latest

Or build from source:

git clone https://github.com/peg/rampart.git
cd rampart
go build -o rampart ./cmd/rampart
sudo mv rampart /usr/local/bin/

Protect Claude Code

Native integration through Claude Code's hook system. One command:

# Install the hook
rampart setup claude-code

# Use Claude Code normally — Rampart evaluates every tool call
claude

# Open the live dashboard in another terminal
rampart watch

Every Bash command, file read, and file write goes through Rampart before execution. Blocked calls never run — Claude Code gets a policy denial and moves on.

Protect any agent

For agents that read the $SHELL environment variable (Aider, OpenCode, Continue, Cline):

rampart wrap -- aider
rampart wrap -- opencode
rampart wrap -- python my_agent.py

For MCP servers:

# Wrap any MCP server — denied tool calls never reach it
rampart mcp -- npx @modelcontextprotocol/server-filesystem .

What gets blocked

The default standard profile blocks out of the box:

Policies are YAML. Write your own or use the built-in profiles: standard, paranoid, yolo.

Details