Rampart documentation

Install Rampart, connect a supported agent, and check the boundary before you rely on it.

Start here¶

Quick Start¶

brew install peg/tap/rampart
rampart protect
rampart verify --all

rampart protect detects and configures supported installed agents. rampart verify --all re-checks policy and configured integrations with an active verifier. A setup check alone is not proof that a host ingests its hooks. Review your agent's support status and limits.

For Linux, Windows, and other install methods, use the installation guide.

What is Rampart?¶

Rampart is a policy engine for actions exposed by a supported agent integration. Hook-visible commands, file operations, fetches, and related tool calls are evaluated against YAML policies before the host executes them. Observed decisions are logged to a hash-chained audit trail. Rampart is not a network firewall or sandbox and does not see arbitrary behavior inside an allowed process.

On supported post-tool boundaries, Rampart can scan tool responses and replace matching string content before the next model turn. This is pattern-based mitigation, not a guarantee that secrets never enter agent context. Learn more →

Frequently Asked Questions¶

Is Claude Code safe to use in --dangerously-skip-permissions mode?
It can be used with an additional policy boundary, but Rampart is not a sandbox. --dangerously-skip-permissions gives Claude Code broad shell access; Rampart evaluates Bash and PowerShell tool calls that Claude exposes to its hooks. Commands executed inside an already allowed interpreter are outside that metadata boundary. Full guide →

What happens if my AI agent runs a destructive command?
With a working native hook, the command is evaluated before execution. If it matches a deny rule, Rampart returns a structured denial and records the decision. Evaluation is normally measured in microseconds, but end-to-end hook latency varies by machine and policy set.

Can AI agents be manipulated by prompt injection?
Yes — a webpage or MCP tool response can contain instructions that try to override an agent's behavior. Rampart's watch-prompt-injection policy checks tool responses for high-confidence patterns and blocks matching responses where the host's post-tool hook can block them. Learn more →

Does Rampart send my commands to any external server?
Core Rampart policy evaluation, audit logging, and the dashboard are local. Optional semantic verification and notification/webhook features send the configured request data to their configured providers. The agent itself may also use remote model and tool services independently of Rampart. Optional external witnessing publishes compact audit checkpoints without commands, prompts or tool-request content.

Will Rampart slow down my agent?
Core matching is local and benchmarked in microseconds. Hook startup and audit I/O add environment-dependent overhead; optional semantic verification adds a network model call.

What if I need to allow a command that's blocked?
If an ask rule keeps prompting, run rampart allow "your command pattern" — no YAML editing required, and the rule applies from the next call. A command blocked by a deny rule stays blocked: allow does not override deny rules. Full guide →

How It Works¶

1. A configured integration exposes an agent's tool request to Rampart.
2. YAML policy returns allow/watch, deny, or ask. Allow and watch let the host continue; deny blocks the represented action; ask requires human approval through the integration's supported path.
3. The local audit trail records the request and policy decision.

action: ask routes directly from policy to human approval; it does not require a semantic verifier. The integration determines whether approval is shown by the host or handled through Rampart. See the native ask guide and your integration guide for the actual boundary.

Only an explicitly matched webhook rule invokes an optional external decision service. The diagram describes policy decisions, not proof of execution or independent audit witnessing.

Architecture · Threat model · Policy schema

Integration Paths¶

See all integration guides

Current release¶

Rampart v1.10.0 stops answering allow for Claude Code: when policy allows an action, Rampart returns no decision, so Claude Code's own permission mode and prompts apply again. Deny and ask rules work as before. New Claude Code installations on 2.1.295 or later fail closed when the hook cannot run; existing installations keep their current behavior until you opt in. rampart doctor now warns, rather than fails, when another detected agent has no Rampart hooks, and rampart protect ends with a harmless test to try. The alpha Python SDK and rampart quickstart are removed. Existing installations need no action. Read the upgrade guidance before upgrading a custom background service, and see the release notes or the repository changelog for history.