BlastShield

Read-Only by Default

BlastShield enforces a default-deny posture for cloud CLIs and package managers. Read operations such as list, describe, get, and plan pass through automatically. Mutating commands such as terraform apply, gcloud deploy, npm install, and pip install are blocked or forced back to the user.

The agent inspects and plans. You execute.

Two Layers of Defense

Layer 1: sandbox-exec profiles

Kernel-level filesystem restrictions keep agents away from credential files, state, and protected paths.

Layer 2: command-argument guard

Runtime guard wrappers intercept dangerous subcommands before they reach Terraform, gcloud, kubectl, npm, pip, and other CLIs.

Quick Start

brew install cdrxyz/tap/blastshield
blastshield claude --dangerously-skip-permissions
blastshield grok --always-approve

Grok Build Support

Grok Build is supported as a first-class CLI agent. BlastShield allows normal Grok runtime state under ~/.grok while keeping auth, config, skills, plugins, and hooks write-protected:

blastshield grok --always-approve
blastshield -p terraform grok --always-approve

Conductor Support

BlastShield supports Conductor as a sandboxed macOS GUI app. Launch Conductor through BlastShield and Conductor-launched Claude Code and Codex agents inherit the sandbox and runtime guards:

blastshield -p gui-app open /Applications/Conductor.app

See the Conductor guide for the supported workflow and profile details.

For manual installation, see Getting Started.