Download
View as Markdown

Guard

Examples

porticol-cli guard scan
porticol-cli guard proxy
porticol-cli guard log verify
porticol-cli guard log export --format csv

Usage

porticol-cli guard scan [<folder>]
porticol-cli guard proxy [--port 7777] [--data-dir <path>]
porticol-cli guard hook <claude|codex|cursor> [--data-dir <path>]
porticol-cli guard log verify [--data-dir <path>]
porticol-cli guard log export --format <json|csv> [--since <date>] [--output <file>] [--data-dir <path>]

Guard

scan reads a folder six levels deep for .env files, .npmrc tokens and service account keys, and your home folder for AWS credentials, .netrc passwords and Kubernetes tokens. It prints where each key is, never its value. proxy serves Guard's local proxy for a sandboxed agent on 127.0.0.1 only: it injects the key the policy names for a host, asks a person before a risky call and records every call. hook answers an agent's hook: claude, codex and cursor each read that hook's JSON on standard input and get the answer their agent expects. Claude Code and Codex leave an HTTP call to Guard's proxy; a command that changes how its calls reach the proxy, or names a guarded host Guard cannot read as one plain call, fails closed, with Claude Code asking and Codex denying. Cursor's hook decides one plain curl, wget or httpie call, asks on a command it cannot read, and waits 25 seconds for a person; it also decides a remote MCP server by its URL. log verify walks every workspace's chain and names the first entry that does not match the one before it. log export writes every entry as JSON or CSV, with no secret value. The CSV's first columns answer a CERT-In request: who, which agent, what call, what decision, which rule, who approved it and when. The column guide is at https://porticol.app/docs/guides/guard-log-export.html

Exit codes

Code Meaning
0 the command ran: keys listed, the proxy stopped when asked, the hook answered, the record was intact, or the export was written
1 the record is broken at an entry that does not match the one before it
2 Codex was denied, with the reason on standard error
3 the command line, a data folder, the policy or the certificate authority is wrong, or the proxy could not run

See also