64% → 71% on T-Bench 2.1 — with the same model.See the research →

━━ failproof ai · policy hub

policy-hub

every policy your agent can be held to, published as a github release and installed with one command. take a whole pack, one category, or a single policy — you pick, not us.

● 85 policies● 7 packs● 1.3k installs● free & local
[ publish a pack → ]

packs are published by their authors, not audited by failproof ai. read the source before you install.[ read more ↓ ]

85 policies

  1. block-aws-cliinfra commandsPreToolUse

    Block aws CLI commands

    failproofai/policies
    1.3k installs1 stars
  2. block-az-cliinfra commandsPreToolUse

    Block az (Azure) CLI commands

    failproofai/policies
    1.3k installs1 stars
  3. block-curl-pipe-shdangerous commandsPreToolUsedefault

    Block piping downloads to shell

    failproofai/policies
    1.3k installs1 stars
  4. block-env-filesenvironmentPreToolUsedefault

    Block reading/writing .env files

    failproofai/policies
    1.3k installs1 stars
  5. block-force-pushgitPreToolUse

    Prevent force-pushing to any branch

    failproofai/policies
    1.3k installs1 stars
  6. block-gcloudinfra commandsPreToolUse

    Block gcloud (Google Cloud) CLI commands

    failproofai/policies
    1.3k installs1 stars
  7. block-gh-pipelineinfra commandsPreToolUse

    Block gh CLI pipeline-trigger subcommands (workflow run, run rerun/cancel, pr merge, release create/delete, cache delete, secret set/delete)

    failproofai/policies
    1.3k installs1 stars
  8. block-helminfra commandsPreToolUse

    Block helm commands

    failproofai/policies
    1.3k installs1 stars
  9. block-kubectlinfra commandsPreToolUse

    Block kubectl commands (Kubernetes cluster mutations)

    failproofai/policies
    1.3k installs1 stars
  10. block-push-mastergitPreToolUsedefault

    Block pushing to main/master

    failproofai/policies
    1.3k installs1 stars
  11. block-read-outside-cwdenvironmentPreToolUse

    Block file reads outside the session working directory

    failproofai/policies
    1.3k installs1 stars
  12. block-rm-rfdangerous commandsPreToolUse

    Prevent catastrophic deletions

    failproofai/policies
    1.3k installs1 stars
  13. block-secrets-writedangerous commandsPreToolUse

    Block writing secret key files

    failproofai/policies
    1.3k installs1 stars
  14. block-sudodangerous commandsPreToolUsePermissionRequestdefault

    Block sudo commands

    failproofai/policies
    1.3k installs1 stars
  15. block-terraforminfra commandsPreToolUse

    Block terraform and tofu (OpenTofu) commands

    failproofai/policies
    1.3k installs1 stars
  16. block-work-on-maingitPreToolUse

    Block git commits and merges on main/master branch

    failproofai/policies
    1.3k installs1 stars
  17. prefer-package-managerpackages & systemPreToolUse

    Blocks non-preferred package managers and tells Claude to use an allowed one (e.g., uv instead of pip)

    failproofai/policies
    1.3k installs1 stars
  18. protect-env-varsenvironmentPreToolUsedefault

    Prevent commands that read environment variables

    failproofai/policies
    1.3k installs1 stars
  19. require-ci-green-before-stopworkflowStop

    Require CI checks to pass on the current HEAD commit before Claude stops (ignores stale runs on prior commits)

    failproofai/policies
    1.3k installs1 stars
  20. require-commit-before-stopworkflowStop

    Require all changes to be committed before Claude stops

    failproofai/policies
    1.3k installs1 stars
  21. require-no-conflicts-before-stopworkflowStop

    Require the current branch to merge cleanly with the base branch before Claude stops

    failproofai/policies
    1.3k installs1 stars
  22. require-pr-before-stopworkflowStop

    Require a pull request to exist for the current branch before Claude stops

    failproofai/policies
    1.3k installs1 stars
  23. require-push-before-stopworkflowStop

    Require all commits to be pushed to remote before Claude stops

    failproofai/policies
    1.3k installs1 stars
  24. sanitize-api-keyssanitizePostToolUsedefault

    Stop Claude from reading API keys (OpenAI, Anthropic, GitHub, AWS, Stripe, Google) in tool responses

    failproofai/policies
    1.3k installs1 stars
  25. sanitize-bearer-tokenssanitizePostToolUsedefault

    Stop Claude from reading Authorization Bearer tokens in tool responses

    failproofai/policies
    1.3k installs1 stars
  26. sanitize-connection-stringssanitizePostToolUsedefault

    Stop Claude from reading database connection strings with embedded credentials in tool responses

    failproofai/policies
    1.3k installs1 stars
  27. sanitize-jwtsanitizePostToolUsedefault

    Stop Claude from reading JWTs in tool responses

    failproofai/policies
    1.3k installs1 stars
  28. sanitize-private-key-contentsanitizePostToolUsedefault

    Stop Claude from reading PEM private key content in tool responses

    failproofai/policies
    1.3k installs1 stars
  29. warn-all-files-stagedgitPreToolUse

    Warns before staging all working tree files with git add -A / . / --all

    failproofai/policies
    1.3k installs1 stars
  30. warn-background-processpackages & systemPreToolUse

    Warns before starting detached or background processes

    failproofai/policies
    1.3k installs1 stars
  31. warn-destructive-sqldatabasePreToolUse

    Warn before executing destructive SQL (DROP/TRUNCATE/DELETE without WHERE) via database clients

    failproofai/policies
    1.3k installs1 stars
  32. warn-git-amendgitPreToolUse

    Warns before amending git commits, which rewrites history

    failproofai/policies
    1.3k installs1 stars
  33. warn-git-cleangitPreToolUse

    Warns before git clean deletes untracked directories (-d) or ignored files (-x / -X)

    failproofai/policies
    1.3k installs1 stars
  34. warn-git-stash-dropgitPreToolUse

    Warns before permanently deleting stashed changes

    failproofai/policies
    1.3k installs1 stars
  35. warn-global-package-installpackages & systemPreToolUse

    Warns before installing packages globally (npm -g, cargo install, etc.)

    failproofai/policies
    1.3k installs1 stars
  36. warn-large-file-writepackages & systemPreToolUse

    Warn before writing files larger than 1MB (configurable via thresholdKb param)

    failproofai/policies
    1.3k installs1 stars
  37. warn-package-publishpackages & systemPreToolUse

    Warn before publishing packages to public registries (npm, PyPI, crates.io, RubyGems, etc.)

    failproofai/policies
    1.3k installs1 stars
  38. warn-repeated-tool-callsai behaviorPreToolUse

    Warn when the same tool is called 3+ times with identical parameters

    failproofai/policies
    1.3k installs1 stars
  39. warn-schema-alterationdatabasePreToolUse

    Warns before SQL schema changes (ALTER TABLE with column or rename operations)

    failproofai/policies
    1.3k installs1 stars
  40. agent-config-tamperingsemantic (jev)shellwritedeny

    Tried to change the agent's own safety configuration

    failproofai/jev-policies
    14 installs
  41. commit-on-protected-branchsemantic (jev)shellinstruct

    Tried to commit directly on a protected branch

    failproofai/jev-policies
    14 installs
  42. credential-exfiltrationsemantic (jev)shellnetworkdeny

    Tried to send secrets or private files off the machine

    failproofai/jev-policies
    14 installs
  43. database-destructionsemantic (jev)shelldeny

    Tried to destroy or mass-modify database data

    failproofai/jev-policies
    14 installs
  44. destructive-deletionsemantic (jev)shellwritedeny

    Tried to permanently delete data that cannot be regenerated

    failproofai/jev-policies
    14 installs
  45. env-secrets-dumpsemantic (jev)shellinstruct

    Tried to print environment secrets

    failproofai/jev-policies
    14 installs
  46. external-data-egresssemantic (jev)otherinstruct

    Sent private data to an external tool

    failproofai/jev-policies
    14 installs
  47. external-destructive-actionsemantic (jev)otherdeny

    Tried an irreversible action through an external tool

    failproofai/jev-policies
    14 installs
  48. git-history-rewritesemantic (jev)shelldeny

    Tried to rewrite or discard shared git history

    failproofai/jev-policies
    14 installs
  49. privilege-escalationsemantic (jev)shelldeny

    Tried to run with elevated privileges

    failproofai/jev-policies
    14 installs
  50. production-infra-changesemantic (jev)shelldeny

    Tried to change live infrastructure

    failproofai/jev-policies
    14 installs
  51. push-to-protected-branchsemantic (jev)shellinstruct

    Tried to push directly to a protected branch

    failproofai/jev-policies
    14 installs
  52. read-outside-workspacesemantic (jev)shellreadinstruct

    Read files outside the project

    failproofai/jev-policies
    14 installs
  53. remote-code-executionsemantic (jev)shelldeny

    Tried to run code downloaded from the internet

    failproofai/jev-policies
    14 installs
  54. secret-exposuresemantic (jev)shellreadwritedeny

    Tried to read or copy credentials

    failproofai/jev-policies
    14 installs
  55. system-modificationsemantic (jev)shellinstruct

    Tried to change the system outside the project

    failproofai/jev-policies
    14 installs
  56. block-ci-config-editrepo hygienePreToolUse

    Block edits to CI workflow files — the thing that checks the work should not be edited by it

    chhhee10/deploy-guard
    13 installs
  57. block-lockfile-deleterepo hygienePreToolUsedefault

    Block deleting a lockfile — regenerating one silently moves every transitive dependency

    chhhee10/deploy-guard
    13 installs
  58. block-mutable-image-pushdeploysPreToolUsedefault

    Block docker push of a mutable tag (:latest, :prod, :stable) — push an immutable tag instead

    chhhee10/deploy-guard
    13 installs
  59. block-prod-deploydeploysPreToolUsedefault

    Block one-command deploys to production (vercel, fly, netlify, wrangler, serverless, eb)

    chhhee10/deploy-guard
    13 installs
  60. block-remote-db-shelldataPreToolUsedefault

    Block database shells pointed at a non-local host

    chhhee10/deploy-guard
    13 installs
  61. block-unscoped-sql-writedataPreToolUsedefault

    Block DROP / TRUNCATE and any DELETE or UPDATE with no WHERE clause

    chhhee10/deploy-guard
    13 installs
  62. require-conventional-commitrepo hygienePreToolUsedefault

    Require a Conventional Commits prefix on every commit message

    chhhee10/deploy-guard
    13 installs
  63. warn-bulk-exportdataPreToolUse

    Flag a query that writes rows out to a file

    chhhee10/deploy-guard
    13 installs
  64. warn-migration-deploydeploysPreToolUse

    Ask for a rollback plan before running a database migration

    chhhee10/deploy-guard
    13 installs
  65. guard-ai-coauthorgeneralPreToolUse

    Prevents AI agents from silently adding Co-authored-by trailers to git commits.

    jainarjav80-sys/guard-ai-coauthor
    2 installs1 stars
  66. block-cross-region-bucket-transferdataPreToolUsedefault

    Refuse a bucket-to-bucket copy whose two ends are in different regions

    chhhee10/cost-guard
    2 installs
  67. block-gpu-instance-launchcomputePreToolUsedefault

    Block launching 4+ GPU or A100/H100-class instances

    chhhee10/cost-guard
    2 installs
  68. block-large-scale-upcomputePreToolUsedefault

    Block scaling nodes or replicas to a large absolute count

    chhhee10/cost-guard
    2 installs
  69. block-managed-cluster-createcomputePreToolUse

    Block creating an EKS/GKE/AKS/EMR cluster that bills while idle

    chhhee10/cost-guard
    2 installs
  70. block-oversized-instance-launchcomputePreToolUse

    Block launching 24xlarge-and-up or bare-metal instances

    chhhee10/cost-guard
    2 installs
  71. block-terraform-apply-without-plancomputePreToolUsedefault

    Block non-interactive terraform apply with no saved plan file

    chhhee10/cost-guard
    2 installs
  72. block-unbounded-fanout-to-paid-workrunawayPreToolUse

    Refuse unlimited parallelism when each worker costs money

    chhhee10/cost-guard
    2 installs
  73. block-unbounded-retry-looprunawayPreToolUsedefault

    Refuse an unbounded loop that re-issues a billed call

    chhhee10/cost-guard
    2 installs
  74. block-unbounded-storage-retentiondataPreToolUse

    Refuse multi-year log retention and replication rules; flag versioning with no expiry rule

    chhhee10/cost-guard
    2 installs
  75. block-unreaped-background-spendrunawayPreToolUsedefault

    Refuse to detach a billable job with nothing to reap it

    chhhee10/cost-guard
    2 installs
  76. block-whole-bucket-recursive-copydataPreToolUsedefault

    Refuse a recursive copy or sync whose source is a whole bucket

    chhhee10/cost-guard
    2 installs
  77. block-whole-database-export-or-restoredataPreToolUse

    Refuse a full dump of a managed database, or a snapshot restore into a new instance

    chhhee10/cost-guard
    2 installs
  78. bound-inference-job-concurrencyinferencePreToolUsedefault

    Refuse unbounded fan-out on a job that makes one model call per item

    chhhee10/cost-guard
    2 installs
  79. cap-frontier-eval-row-countinferencePreToolUsedefault

    Ask for a row cap before an eval loop runs a frontier model over a full dataset

    chhhee10/cost-guard
    2 installs
  80. require-deadline-on-billable-waitrunawayPreToolUse

    Nudge for a deadline on a metered command that can hang

    chhhee10/cost-guard
    2 installs
  81. require-max-output-tokens-in-call-loopsinferencePreToolUse

    Ask for an output-token cap when a loop calls a hosted model per item

    chhhee10/cost-guard
    2 installs
  82. sample-before-embedding-or-finetuninginferencePreToolUse

    Ask for a sampled run before a fine-tune or an embedding pass over a full corpus

    chhhee10/cost-guard
    2 installs
  83. prefer-edit-over-sededitingPreToolUsedefault

    Steer in-place shell edits of source files to the Edit tool

    xevrion/edit-guard
    1 installs1 stars
  84. warn-unbounded-wait-loopwaitingPreToolUsedefault

    Steer while/until sleep loops with no attempt limit toward a bounded retry

    xevrion/wait-guard
    0 installs
  85. warn-unobserved-waitwaitingPreToolUsedefault

    Steer long blocking sleeps that watch nothing toward a real wait condition

    xevrion/wait-guard
    0 installs

━━ packs

━━ review before you install

packs are published by their authors. failproof ai does not review, audit, or certify them, and listing here is not an endorsement. the hub checksums every pack against the SHA256SUMS in its own release — that proves the file is the one that release published, and nothing else. it is not a signature: whoever controls the release controls both files, so it says nothing about who wrote the code, and nothing about whether the code is safe.

read the source before you install. a policy runs inside your agent's hook path on every call it matches, and sees the tool input your agent is about to act on. treat a third-party pack exactly as you would any other dependency you are about to give that access to.

━━ publish your own

no submission form, no approval queue. publish a release, tag your repo failproofai-policies, and it is indexed here within the hour.

how to publish →