Rollcage

Rollcage gives Claude a safety check to run before it acts. Before it runs a shell command, opens a file or sends data to a site, Claude can ask Rollcage whether the action would be blocked, needs your approval, or is fine, and why. Rollcage uses the rules of rollcage-guard, an open-source project (MIT licence), with their default settings. The server is free and public, needs no account or API key, and stores nothing. It runs on rollcage.app, so it can’t see or change anything on your machine.

Tools

check_command: takes a shell command and returns block, ask or allow, with the reason. It never runs the command. Blocks: reading secret files commands that print environment variables (env, printenv, echo $API_KEY) one-line scripts that read environment variables (python -c, node -e…) rm -rf ~, git clean -f, DROP DATABASE, erasing disks uploads to paste, file-drop and tunnel sites Asks first: git reset --hard, force pushes, pushes to main or production curl | sh, sudo, terraform destroy deleting cloud resources, DELETE requests to remote APIs connecting to remote databases check_file: checks a list of paths and says which are secret files an agent shouldn’t read: .env files, keys and certificates, cloud credentials, service-account JSON, Terraform state, ~/.ssh, ~/.aws. Templates such as .env.example are allowed. check_url: checks a URL or host against the list of paste, file-drop, request-capture and tunnel sites (pastebin, transfer.sh, webhook.site, ngrok, trycloudflare…), which are the usual way keys and code leave a machine. It can also apply a stricter mode that only allows listed sites. list_rules: the full default rule set, with an action for each rule. Claude uses it to explain why something was flagged. install_guard: install steps for the local rollcage-guard hook, which enforces the same rules on every tool call in Claude Code, Codex CLI, Cursor and Gemini CLI, plus the hook entry for each agent’s config file. search_docs / get_doc: Rollcage’s guides to ru