failproofai

Translations: 简体中文 · 日本語 · 한국어 · Español · Português · Deutsch · Français · Русский · हिन्दी · Türkçe · Tiếng Việt · Italiano · العربية · עברית

Observability and enforcement for every harness your agents run in. Wherever your agents run, we see it — and we can say no. Failproof hooks 12 agent harnesses — coding CLIs like Claude Code and Codex, chat gateways like Hermes, self-hosted assistants like OpenClaw — capturing every run and blocking dangerous tool calls before they execute. 40 built-in policies. Zero latency. Runs locally.

---

Supported harnesses

Twelve harnesses in two classes — ten coding CLIs, and two chat and assistant gateways (Hermes, OpenClaw). One policy API and one session history across all of them. What a policy can block is per-harness: stopping a tool call before it runs is verified on all twelve, turn-end gates on eight. The per-harness matrix lists the events each one honours.

Agents that run in none of them report through the Python SDK, which gives you tracing, sessions and audits. Enforcement there needs a hook in your own runtime — talk to us and we'll map it.

Install

npm install -g failproofai
failproofai config                             # wire up your agents and the daemon
failproofai policies add FailproofAI/policies  # choose what to enforce
failproofai                                    # dashboard on localhost:8020

Setup wires the hooks and picks no policies — that second command is what puts guardrails on the machine, and any pack is typed the same way (failproofai policies add <owner>/<repo>; policies show <owner>/<repo> reads one first). Run failproofai config with no terminal — CI, a container, an agent driving it — and it applies rather than asking. On a machine that has never been set up, any other command runs the same wizard first; disable that with FAILPROOFAI_NO_FIRST_RUN=1.

Until a pack arrives, the only thing enforcing is block-failproofai-commands, which is always on and cannot be switched off or paused: an agent that can pause enforcement can switch off every other policy.

---

What it stops

Policy	What it blocks
block-env-files	Reads of .env and other secret files
warn-repeated-tool-calls	The agent looping on the same call
block-sudo	Privilege escalation
warn-destructive-sql	DROP, TRUNCATE, unbounded DELETE
block-terraform / block-kubectl	Unreviewed changes to live infrastructure
block-rm-rf	Recursive file deletion
block-force-push / block-push-master	git push --force, direct pushes to main

Every one of these gates the call before it runs, so they hold on all twelve harnesses. The first four apply to any agent that can call a tool; the last three are the developer favourites — coding CLIs are the harness class we cover deepest. The sanitize-* family is separate: it runs after a tool returns, so it reports a secret in tool output rather than keeping it out of the context.

→ All 40 built-in policies

---

Your own policies

Drop a file into .failproofai/policies/ — it loads automatically, no flags needed. Commit it and the whole team gets it on next pull.

import { customPolicies, deny, allow } from "failproofai";

customPolicies.add({
  name: "no-production-writes",
  match: { events: ["PreToolUse"] },
  fn: async (ctx) => {
    if (ctx.toolInput?.file_path?.includes("production"))
      return deny("Writes to production paths are blocked.");
    return allow();
  },
});

Three decisions available to every policy:

Decision	Effect
allow()	Permit the operation
deny(message)	Block it — message goes back to the agent
instruct(message)	Let it through, but add context to the agent's next prompt

→ Write a policy

---

Observability

Enforcement is one half. The other half is seeing what the agent actually did.

Run failproofai with no arguments and it serves a dashboard on localhost:8020 reading the run history already on your machine — no account, no signup, nothing leaving the box. You get the session list, the sequence of model calls, tool calls and hook decisions inside each run, what was blocked and what the policy told the agent, and an offline audit (failproofai audit) that scans your history for risky patterns and suggests policies to stop them.

→ Local dashboard · Read a trace · Local audit

Failproof AI Observability is the hosted side of the same data model, for teams running agents across a fleet: every run from every harness in one place, an execution graph with parallel sub-agents on their own lanes, p50/p95/p99 latency for models, tools and hooks, per-model cost and context-window tracking, error tracking, SQL over your own traces with shareable dashboards, evaluations scored by your own service, scheduled audits that turn recurring failures into evidence-backed findings, and alerts routed to Slack, email or a signed webhook. Self-hosting in your own cluster is available on the Enterprise plan.

→ Sessions · Audits · Book a demo

---

Documentation

Start
Quickstart	Install, connect a harness, see the first run
Concepts	How the hook system works
Supported harnesses	All 12, and what each one can enforce

Observe
Sessions	Follow a run: models, tools, errors, latency
Read a trace	What the execution graph is telling you
Audits	Find failure patterns across many sessions
Local dashboard	localhost:8020, no account needed

Enforce
Policy packs	The Failproof AI policies, and packs from the policy hub
Write a policy	From an audit, or in code
Configuration	Config scopes, merge rules and policy parameters

Instrument your own agent
Python SDK	Report runs from an agent with no harness
Policy SDK	allow / deny / instruct reference

---

License

MIT with Commons Clause — free for internal and personal use; commercial resale of failproofai itself requires a separate agreement. See LICENSE for the full text.

---

Contributing

See CONTRIBUTING.md. New policies, edge cases, and translations all welcome.

---

Built with ❤️ by befailproof.ai in SF and Bengaluru.