Open-source guardrail

Dropping a database from the command line

AgentTrail Guard blocks this by default: the call never runs, and your coding agent is told which guardrail stopped it.

Default action
Block
Severity
Critical severity
Library version
0.2.1Sep 29, 2026

What it catches, and what it misses

Written into the rule itself, next to what it matches, so you can judge it before you trust it.

Deletes a whole database through a shell tool rather than through SQL — dropdb, MongoDB's dropDatabase(), and the AWS RDS delete calls. It is the companion to block-destructive-sql, which sees the SQL statement but not dropdb myapp, because that command contains no DROP DATABASE phrase. Known over-match: dropdb --help is matched too, since the rule reads command text and cannot tell a help flag from a target. It does NOT cover a drop issued by application code or by a migration tool (see dd.migration-reset). A global flag between aws and rds is tolerated (aws --profile <p> rds delete-db-instance …, --region <r>); dropdb and dropDatabase() are single commands with no subcommand gap to exploit, and an absolute tool path still matches. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt.

Tested on every build

The rule must match every command on the left and none on the right, or the library does not build. Catching the real thing is easy; staying quiet on the near-miss is the hard part.

Catches (5)

  • dropdb myapp_production
  • mongosh --eval 'db.dropDatabase()'
  • aws rds delete-db-instance --db-instance-identifier prod-1
  • aws --profile prod rds delete-db-instance --db-instance-identifier prod-1
  • MCP{"command":"dropdb myapp_production"}

Stays quiet on (8)

  • git commit -m "docs: explain dropdb myapp_production"
  • grep -rn "dropdb myapp_production" docs/
  • echo "never run dropdb myapp_production"
  • curl --data "we ran dropdb myapp_production" https://api.example.com/comments
  • createdb myapp_test
  • pg_dump myapp > dump.sql
  • aws rds describe-db-instances
  • mongosh --eval 'db.stats()'

What "block" means in each app

The guard runs as a hook in each app, and each app gives a hook different powers. Here is what this rule's default action does in each one.

Claude Code
The call never runs, and the agent is told which guardrail stopped it.
Cursor
The call never runs. Cursor shows no reason of its own, so the agent retells the guardrail's message in its own words.
Codex CLI
The command never runs, and Codex prints the guard's reason on screen.

Each app hands the guard a different set of calls: in a Cursor sandbox run mode, for one, some terminal commands run without reaching the guard at all. Read the notes for Cursor and for Codex CLI before you rely on a rule there.

Change what it does in one command

Turn it off, change its action, or silence it on one command shape. The narrow one is allow: the rule keeps catching everything else.

agenttrail-guard
$agenttrail-guard guardrails show dd.database-drop# everything about it
$agenttrail-guard guardrails set-action dd.database-drop ask# block, ask or warn
$agenttrail-guard guardrails allow dd.database-drop '<pattern>'# silence one shape
$agenttrail-guard guardrails disable dd.database-drop# turn it off

Put these guardrails in front of your agent.

AgentTrail Guard is free and open source. It checks every command and file change against the whole library before your agent runs it, on your machine, with no account.

bash
$npm i -g @agenttrail/guard
Read the source on GitHub