AGENT SEATBELT

Agent Seatbelt

Last updated November 11, 2026

"A seatbelt for AI coding agents." That is the README's own tagline. What sits behind it is a deterministic policy gate: it decides what an agent may do before the agent does it.

What it does

One self-contained Python file reads every tool call before it runs: shell commands, file writes, and MCP calls. It denies or escalates the ones that end careers, such as recursive deletes, secret exfiltration, production deploys, agent-bypass launches, and memory poisoning. Every verdict names its rule, its blast radius, and the safer path.

Deobfuscation before judgment: quote fragments, $IFS, escapes, command substitution, base64, interpreter -c calls, and aliases are unwrapped before a call is judged.
Locked rules, strictest wins: Bash and PowerShell destruction, git destruction, cloud and database deletion, deploys and publishes, pipe-to-shell, secret reads, secret exfiltration over the network, sudo, persistence, reverse shells, tunnels, TLS bypass, crypto mining, and agent-bypass launches.
Policy packs: solo, team-strict, ci, and paranoid. A pack can only add restrictions, never loosen the locked rules.
Blast radius: every serious verdict names what the call would have hit.
Snapshots before destruction: bounded at 2,000 files and 256 MB, with a one-command, hash-verified restore.
Injection flagging: a flagged prompt injection taints the session for 30 minutes.
Drift watch: memory files such as CLAUDE.md and AGENTS.md, settings, and installed skills and plugins are watched for drift.
MCP rug-pull watch: server configuration and tool-surface fingerprints are checked for silent changes, key names only.
Judge escalation: an opt-in seam that can raise a verdict one tier, and never lower it.
Flight plans: a session can declare a plan in .seatbelt/plan.json, and ask-tier actions inside the plan proceed without a prompt. A plan never covers a denial.
Rehearsal previews: dry-run twins show what a call would do before it runs.
Canary honeytokens: decoy values planted where an exfiltration attempt would find them.
Tamper-evident audit: every verdict lands in a hash-chained log at .seatbelt/audit.jsonl, with secrets redacted.
Self-protection: the agent cannot edit the hook, the policies, the audit log, or the baselines.
Library and CLI: the original Python library, agent_seatbelt, and a command line interface ship alongside the hook.

See it work

The README's own example, a call checked before anything runs:

$ python3 hooks/seatbelt_hook.py --check "rm -rf ~/project"
DENY  rule=seatbelt-locked-rm-rf
  reason: recursive forced deletion (rm with -r and -f) is irreversible
  Safer path: List the targets first (ls), move them to a
  quarantine/trash directory, and delete only after checking.

Try the policy gate

What this is: a small in-browser demonstration of a subset of the Seatbelt 0.3.2 locked rules, ported from the shipped Python. It runs entirely on this page; nothing you type is sent anywhere. The real gate is the Python package, pip install ghost-seatbelt. The full gate also covers file writes, MCP calls, PowerShell, and code, and a project policy can only tighten it, never loosen the locked rules.

Pick a preset, or type a call and press Check.

The three presets and their verdicts, as plain text so they also read with JavaScript off:

git push --force origin main: DENY, seatbelt-locked-git-force-push. Force push rewrites shared history.
git status: ALLOW, seatbelt-safe-allow. A read-only command on the conservative safe list.
npm publish: ASK, seatbelt-locked-deploy-publish. Deploy, publish, and push change what the world runs.

Get it

Version 0.3.2. MIT license. Runs on Python 3.10 or later. The README states it plainly: no network, no telemetry, no dependencies.

Claude Code plugin:

claude plugin marketplace add littlestjames82-sys/agent-seatbelt
claude plugin install agent-seatbelt@agent-seatbelt

PyPI library:

pip install ghost-seatbelt
python3 -m agent_seatbelt --help

Direct hook installer (dry run first):

python3 install.py --dry-run
python3 install.py

Proof and listings

The README reports, for 0.3.2: Seatbelt Bench 272/272 cases, GuardFall fuzz 1853/1853, injection 15/15 with 0 false positives.

The free companion skill, Agent Seatbelt Guardrails, teaches an agent how to live with this gate: treat denials as final, present ask-tier actions with their real blast radius, and read the audit log. It is free in the Hub, with a complete listing record.

Honest limits

Seatbelt gates the tool-call path only. That is the README's own scope statement: what never reaches a tool call sits outside the gate.

Claude Code is the reference surface, with a true ask. The other surfaces (Codex, Cursor, Cline, OpenCode, and the Gemini legacy surface) are simulated-tested, not live-tested.

Questions? See the Hub help center.