Skip to content

Any CLI Agent

rampart wrap works with any agent that reads the $SHELL environment variable. This covers most CLI-based AI agents.

Setup

rampart wrap -- <your-agent-command>

Examples

rampart wrap -- aider
rampart wrap -- opencode
rampart wrap -- python my_agent.py
rampart wrap -- node agent.js

How It Works

  1. Rampart starts an embedded policy server
  2. Generates a shell shim that checks commands launched through that shim against the policy
  3. Sets $SHELL to point at the shim
  4. Execs your agent as a child process

Commands the agent launches through the declared $SHELL reach the shim, which checks the preflight API and allows or blocks them. Direct process spawning, native file/network APIs, and a shell path the agent ignores are outside this boundary.

Agent → spawns shell → $SHELL (rampart shim) → Policy Engine → Allow/Deny/Ask

Ask behavior: The shell shim blocks execution and waits for human resolution via rampart approve <id> or the API. The agent sees the command as "hung" until resolved.

Monitor Mode

Log everything, block nothing — useful for understanding what your agent does before writing policies:

rampart wrap --mode monitor -- your-agent

Review the log, then write policies:

rampart audit stats
rampart report

Custom Policy

rampart wrap --config /path/to/policy.yaml -- your-agent

Platform Support

rampart wrap requires Linux or macOS. For Windows, use the HTTP API or MCP proxy.

When Wrap Doesn't Work

If your agent doesn't respect $SHELL, use LD_PRELOAD instead:

The native library is not included in release archives or Homebrew. From a matching Rampart source checkout, run make -C preload install first.

rampart preload -- your-agent

This interposes supported libc exec/spawn functions in compatible dynamically linked processes, independently of $SHELL. It does not cover static binaries, direct syscalls, secure-execution/SIP contexts, or runtimes that bypass those symbols; use native host hooks or OS containment when available.