Rampart documentation

Install Rampart, connect a supported agent, and check the boundary before you rely on it.

Start here¶

Quick Start¶

brew install peg/tap/rampart
rampart protect
rampart verify --all

rampart protect detects and configures supported installed agents. rampart verify --all re-checks policy and configured integrations with an active verifier. A setup check alone is not proof that a host ingests its hooks. Review your agent's support status and limits.

For Linux, Windows, and other install methods, use the installation guide.

What is Rampart?¶

Rampart is a policy engine for actions exposed by a supported agent integration. Hook-visible commands, file operations, fetches, and related tool calls are evaluated against YAML policies before the host executes them. Observed decisions are logged to a hash-chained audit trail. Rampart is not a network firewall or sandbox and does not see arbitrary behavior inside an allowed process.

On supported post-tool boundaries, Rampart can scan tool responses and replace matching string content before the next model turn. This is pattern-based mitigation, not a guarantee that secrets never enter agent context. Learn more →

Frequently Asked Questions¶

Is Claude Code safe to use in --dangerously-skip-permissions mode?
It can be used with an additional policy boundary, but Rampart is not a sandbox. --dangerously-skip-permissions gives Claude Code broad shell access; Rampart evaluates Bash and PowerShell tool calls that Claude exposes to its hooks. Commands executed inside an already allowed interpreter are outside that metadata boundary. Full guide →

What happens if my AI agent runs a destructive command?
With a working native hook, the command is evaluated before execution. If it matches a deny rule, Rampart returns a structured denial and records the decision. Evaluation is normally measured in microseconds, but end-to-end hook latency varies by machine and policy set.

Can AI agents be manipulated by prompt injection?
Yes — a webpage or MCP tool response can contain instructions that try to override an agent's behavior. Rampart's watch-prompt-injection policy monitors tool responses for these patterns and logs them for review. Learn more →

Does Rampart send my commands to any external server?
Core Rampart policy evaluation, audit logging, and the dashboard are local. Optional semantic verification and notification/webhook features send the configured request data to their configured providers. The agent itself may also use remote model and tool services independently of Rampart. Optional external witnessing publishes compact audit checkpoints without commands, prompts or tool-request content.

Will Rampart slow down my agent?
Core matching is local and benchmarked in microseconds. Hook startup and audit I/O add environment-dependent overhead; optional semantic verification adds a network model call.

What if I need to allow a command that's blocked?
Run rampart allow "your command pattern" and it's done — no YAML editing required. The rule takes effect immediately. For one-time exceptions, use action: ask in your policy so you can approve each instance. Full guide →

How It Works¶

1. A configured integration exposes an agent's tool request to Rampart.
2. YAML policy returns allow/watch, deny, or ask. Allow and watch let the host continue; deny blocks the represented action; ask requires human approval through the integration's supported path.
3. The local audit trail records the request and policy decision.

action: ask routes directly from policy to human approval; it does not require a semantic verifier. The integration determines whether approval is shown by the host or handled through Rampart. See the native ask guide and your integration guide for the actual boundary.

Only an explicitly matched webhook rule invokes an optional external decision service. The diagram describes policy decisions, not proof of execution or independent audit witnessing.

Architecture · Threat model · Policy schema

Integration Paths¶

See all integration guides

Current release¶

Rampart v1.9.1 improves path evaluation, complete action approvals, diagnostic redaction and audit recovery. Status now distinguishes the running service's mode from the policy's default action, and setup examples are corrected. Read the upgrade guidance for approval-state backups and native OpenClaw review limits. See the release notes for the concise upgrade summary or the repository changelog for history.