CLI Commands¶

Complete reference for all rampart commands.

Agent Setup¶

rampart protect¶

Detect installed supported agents, install their strongest native Rampart boundary, start the local policy service, and verify the result. OpenClaw uses its live plugin path; native-hook agents verify installed configuration and the real Rampart adapter without invoking a model. No policy authoring is required.

rampart protect                       # Detect and protect supported installed agents
rampart protect copilot               # Protect Copilot CLI and VS Code agent sessions
rampart protect openclaw              # Install, activate, restart, and verify
rampart protect openclaw --serve-url http://127.0.0.1:19090
rampart protect openclaw --reinstall  # Replace the plugin even when versions match
rampart protect openclaw --no-restart # Configure without restarting the gateway
rampart protect openclaw --no-verify  # Configure without running behavioral canaries

The command installs managed Guard and OpenClaw policies, enables the bundled native plugin, starts the local policy service, configures every OpenClaw tool to fail closed when Rampart is unavailable, restarts the gateway, and runs safe behavioral verification. On OpenClaw versions that require capability consent for external plugins, setup, forced reinstall, and Doctor repair accept only the exact capability surface OpenClaw reports for Rampart's bundled plugin and use the host's consent-aware enable command. Rampart preserves a valid canonical tools.exec.mode; on upgraded configs it removes only semantically equivalent retired tools.exec.ask/security siblings and refuses conflicting mixed policies. Existing unrelated OpenClaw settings and custom Rampart policy files are preserved.

An explicit --serve-url is authoritative for startup checks, host configuration, and verification. OpenClaw's native plugin accepts only a loopback HTTP(S) service. A non-default explicit endpoint must already be reachable; Rampart does not silently start or verify against the default port. Managed protection currently rejects the global --config override because it cannot yet prove that an already-running or installed service uses the same file. Advanced custom-config deployments should use rampart serve install, the appropriate rampart setup <agent> command, and explicit verification.

rampart quickstart (deprecated compatibility)¶

Preserves the older profile-selection and wrap-guidance workflow while routing supported native integrations through the same managed protection path as rampart protect. New installations should use rampart protect.

rampart quickstart                  # Legacy compatibility workflow
rampart quickstart --yes            # Compatibility spelling for existing scripts
rampart quickstart -y               # Short compatibility spelling

Quickstart remains non-interactive. --yes / -y, --profile, and wrap-only agent guidance remain available so existing scripts continue to work, but new onboarding and repair flows should use rampart protect.

rampart verify¶

Actively test expected policy decisions with fixed, non-executing canaries.

rampart verify --all            # Verify policy + every configured active-verifier integration
rampart verify --all --json     # Emit aggregate schema rampart.verify-all.v1
rampart verify openclaw        # Verify policy plus the live OpenClaw plugin path
rampart verify claude-code     # Verify Claude hook installation and adapter denial
rampart verify cline           # Verify Cline hook installation and adapter denial
rampart verify codex           # Verify Codex hook installation and adapter denial
rampart verify gemini          # Verify Gemini hook installation and adapter denial
rampart verify antigravity     # Verify Antigravity plugin installation and adapter denial
rampart verify copilot         # Verify shared Copilot hook and dual-host denial
rampart verify policy          # Verify the local Rampart policy path
rampart verify openclaw --json # Emit schema rampart.verify.v1

Verification does not execute represented commands, read represented target files, send represented messages, or contact represented external hosts. Configuration and adapter checks do read local installation files. HTTP preflight canaries skip normal audit persistence; native-hook adapter checks can write isolated local audit records. A failed expectation exits with status 1; an incomplete or unreachable check exits with status 2. Human and JSON reports identify the resulting policy_verified, adapter_verified, host_verified, unverified, or degraded assurance level.

--all always checks the policy path, then every configured integration on the current platform that exposes an active safe verifier. It does not invoke a model. Static-only integrations are excluded rather than counted as passing; use rampart doctor for their installation status. The aggregate JSON report uses rampart.verify-all.v1, retains the per-target rampart.verify.v1 reports, and exits 1 if any target fails or 2 if none fail but at least one is unverified.

Unavailable OpenClaw configuration discovery remains an unverified target in --all. The --timeout budget applies independently to each active policy request or host observation; it is not a total command deadline. Installation metadata lookups retain their own bounded discovery budget.

For integration targets, a completed run also records a minimal verification receipt under ~/.rampart/verification/. The receipt contains check IDs and outcomes, Rampart build identity, an environment fingerprint, and timestamps; it does not contain prompts, commands, host output, credentials, or filesystem paths. OpenClaw's live plugin verifier earns host_verified; the ordinary native-hook commands earn adapter_verified because they invoke Rampart's adapter without asking a model to act. Receipts expire after seven days and are treated as stale when Rampart, the configured boundary, the selected policy endpoint, local policy-file metadata, or a detected host executable changes. They are local status caches, not tamper-resistant attestations. Service-backed receipts do not bind the service endpoint, instance, build, and mode into one observation. Status therefore retains their timestamps but does not promote current service-backed assurance from a cached receipt. A live OpenClaw result establishes loaded mapping checks. Matching installed plugin files does not identify the gateway's loaded plugin build; the running service build and dispatched tool actions also require separate evidence.

rampart setup claude-code¶

Install native hooks into Claude Code. Adds a PreToolUse hook to ~/.claude/settings.json — no LD_PRELOAD or shim needed.

rampart setup claude-code           # Install hooks
rampart setup claude-code --force   # Overwrite existing hooks
rampart setup claude-code --remove  # Remove hooks

Hooks are written to ~/.claude/settings.json and intercept tool calls at the PreToolUse lifecycle point. A PostToolUseFailure hook is also registered to prevent Claude Code from repeatedly retrying denied operations. Both exec and file operations are covered natively — no --patch-tools equivalent needed.

rampart setup cline¶

Install native hooks into Cline.

rampart setup cline                              # Shared user hooks
rampart setup cline --workspace                  # .clinerules/hooks
rampart setup cline --hooks-dir /path/to/hooks   # Explicit runtime directory
rampart setup cline --remove                     # Remove owned user hooks

Rampart installs direct executable PreToolUse/PostToolUse files on Linux and macOS, or direct .ps1 files on Windows. It upgrades the owned nested layout from older Rampart versions but never overwrites or removes another owner's hook, including with --force. --data-dir is accepted for Cline CLI parity, but current Cline source does not use --data-dir or CLINE_DATA_DIR for hook discovery. Do not use Cline CLI's legacy --yolo mode when relying on Rampart because current Cline disables runtime hooks in that mode.

rampart setup openclaw¶

Install the Rampart integration for OpenClaw without applying the managed zero-configuration Guard posture. This remains available for advanced and legacy configurations; new installations should normally use rampart protect openclaw.

rampart setup openclaw           # Auto-detect: native plugin (>= 2026.3.28) or legacy shim
rampart setup openclaw --plugin  # Force native plugin install (requires >= 2026.3.28)
rampart setup openclaw --migrate # Migrate from legacy shim/bridge to native plugin
rampart setup openclaw --force   # Overwrite existing config
rampart setup openclaw --remove  # Remove integration

Native plugin (OpenClaw >= 2026.3.28): Installs the bundled before_tool_call hook plugin. Intercepts supported OpenClaw tool calls (exec, read, write, web_fetch, browser, message); degraded behavior depends on tool class and configuration. Plugin is embedded in the rampart binary — no external download required.

Legacy shim (OpenClaw < 2026.3.28): Installs shell shim + optionally patches file tools via --patch-tools. This is a compatibility path and requires re-running after OpenClaw upgrades.

rampart setup codex¶

Install Rampart lifecycle hooks for Codex CLI, IDE, and desktop.

rampart setup codex                   # Install PreToolUse/PostToolUse hooks
rampart setup codex --force           # Replace an invalid hooks.json
rampart setup codex --remove          # Remove Rampart hooks

Rampart writes wildcard PreToolUse and PostToolUse handlers to $CODEX_HOME/hooks.json (or ~/.codex/hooks.json). Existing unrelated hooks remain in place. The generated definition includes POSIX and Windows commands, does not replace the codex executable, and requires no preload library.

rampart setup gemini (experimental)¶

Install experimental Rampart lifecycle hooks for enterprise/API-key Gemini CLI.

rampart setup gemini           # Install BeforeTool/AfterTool hooks
rampart setup gemini --force   # Replace invalid hook configuration
rampart setup gemini --remove  # Remove only Rampart hooks

Rampart writes wildcard BeforeTool and AfterTool entries to ~/.gemini/settings.json while preserving unrelated settings and hooks. Allowed calls continue through Gemini CLI's own permission checks. Gemini's hook protocol has no native ask result, so approval-required calls use Rampart's external queue and deny when rampart serve is unavailable. This is an explicit testing path and is not installed by bare rampart protect; it does not claim Antigravity compatibility.

rampart setup copilot¶

Install one shared hook integration for GitHub Copilot CLI and VS Code agent sessions.

rampart setup copilot                   # Install the shared user hook
rampart setup copilot --force           # Replace a foreign rampart.json file
rampart setup copilot --remove          # Remove the managed user hook
rampart setup copilot --policy          # Elevated: install Copilot CLI machine policy
rampart setup copilot --policy --remove # Elevated: remove the CLI machine policy

Rampart writes $COPILOT_HOME/hooks/rampart.json (normally ~/.copilot/hooks/rampart.json) with PascalCase PreToolUse and PostToolUse events. Copilot CLI emits the VS Code-compatible payload for these events, so the same adapter protects both hosts. The --policy form is Copilot CLI-only; managed VS Code deployment requires the user hook plus VS Code enterprise/MDM controls. Copilot CLI hook timeouts are upstream fail-open, including policy hooks.

rampart setup cursor¶

Install Rampart's user-level native hook for local Cursor Agent and Cmd+K tool calls.

rampart setup cursor           # Install or repair the managed preToolUse entry
rampart setup cursor --force   # Replace invalid hook structure
rampart setup cursor --remove  # Remove only Rampart's entry

Rampart preserves unrelated entries in ~/.cursor/hooks.json and installs its hook with failClosed: true. The setup command does not write Cursor's project, team, enterprise, or Cloud Agent configuration. Use rampart protect cursor for the managed service, Guard policy, setup, and verification journey.

rampart setup (deprecated interactive wizard)¶

Auto-detects installed agents and guides you through setup. The bare wizard remains available throughout Rampart 1.x for compatibility, but is deprecated and planned for removal in 2.0. Use rampart protect for managed onboarding, service startup, and verification. Integration-specific setup subcommands remain supported for advanced operations.

rampart setup                # Deprecated compatibility wizard
rampart setup --force        # Deprecated unattended compatibility path

rampart upgrade¶

Upgrade Rampart to the latest or a specified release. Downloads from GitHub releases, verifies SHA256, atomically replaces the binary, and restarts a running background, systemd, or launchd Rampart service so it uses the new executable. Homebrew-managed installations must use brew upgrade rampart; Windows installations must rerun install.ps1.

rampart upgrade              # Upgrade to latest release
rampart upgrade v0.8.0       # Upgrade to a specific version
rampart upgrade --yes        # Skip confirmation prompt
rampart upgrade --dry-run    # Preview without making changes
rampart upgrade --no-policy-update  # Skip refreshing built-in policy profiles
rampart upgrade --no-binary # Refresh managed policies without replacing the binary

Custom serve --background launches do not retain their original options or working directory through automatic restart. This includes the incoming v1.9.1 updater: the destination binary cannot repair a restart already performed by the old executable. Stop the service, install the new binary, and restart with the original options and CWD using the manual migration. Automatic background preservation and recovery remain outside this release.

After upgrade, standard policy profiles (standard.yaml, paranoid.yaml, yolo.yaml) in ~/.rampart/policies/ are refreshed automatically. Custom policy files are never modified. Run rampart protect once afterward to refresh Rampart-managed hooks and plugins and verify every detected agent boundary; unrelated host configuration is preserved.

rampart uninstall¶

Remove Rampart from the system. Removes agent hooks, stops and removes the service, cleans up PATH entries (Windows), and removes the shell shim.

rampart uninstall            # Interactive (prompts for confirmation)
rampart uninstall --yes      # Skip confirmation prompt

The command removes only Rampart-owned integration artifacts and preserves agent credentials, histories, sessions, memories, workspaces, and unrelated configuration. It exits unsuccessfully if an owned integration cannot be removed completely. Rampart policies and audit logs remain under ~/.rampart/ until the operator deletes or archives them explicitly.

After running, delete ~/.rampart/ manually and remove any rampart-related lines from your shell profile.

Core Commands¶

rampart hook¶

Hook handler called by Claude Code, Cline, Codex, Cursor, experimental Gemini CLI, and GitHub Copilot CLI / VS Code. Reads a tool call from stdin and writes the host's native decision schema to stdout.

echo '{"tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' | rampart hook

rampart serve¶

Start the HTTP policy proxy.

rampart serve                              # Default (port 9090, localhost only)
rampart serve --addr 127.0.0.1             # Bind to localhost only
rampart serve --port 8080                  # Custom port
rampart serve --config policy.yaml         # Custom policy
rampart serve --audit-dir /var/log/rampart # Custom audit log directory
rampart serve --syslog localhost:514       # With syslog output
rampart serve --cef                        # With CEF file output
rampart serve --syslog localhost:514 --cef # CEF to syslog
rampart serve --tls-auto                   # HTTPS with auto-generated self-signed cert
rampart serve --tls-cert cert.pem --tls-key key.pem  # HTTPS with your own cert

--addr takes a bare IP address (e.g. 127.0.0.1, 0.0.0.0, ::1). Defaults to 127.0.0.1 (localhost only) — use --addr 0.0.0.0 to listen on all interfaces. --audit-dir sets the directory for audit log output (defaults to ~/.rampart/audit/).

--tls-auto generates a self-signed ECDSA P-256 certificate (1-year validity) and stores it in ~/.rampart/tls/. A truncated SHA-256 fingerprint is printed on startup. --tls-cert and --tls-key must be used together and are mutually exclusive with --tls-auto.

Diagnostic log retention¶

rampart serve --background writes diagnostics to ~/.rampart/serve.log. Rampart rotates application log records at 10 MiB and retains three backups, named serve.log.1 through serve.log.3, with .1 the newest. The active file and newly rotated files are owner-only. Common credential values are redacted before writing; diagnostic records larger than 64 KiB are omitted entirely. Audit history has separate storage and retention and is not deleted by this rotation.

Use --log-file /path/to/serve.log to enable the same behavior for a foreground process; the parent directory must exist. A newly installed macOS service uses this writer too. Reinstall the managed service to update an older launchd configuration. Linux services continue to use journald and its retention policy.

An existing oversized active log is rotated on startup and remains until it ages out of the three-backup set. Files written directly by a supervisor or runtime outside Rampart's application logger remain subject to that writer's behavior. Rotation is diagnostic housekeeping, not an immutable audit mechanism.

rampart wrap¶

Add policy enforcement to agents that launch commands through $SHELL.

This is a cooperative boundary for $SHELL and PATH-resolved common shells. Absolute shell paths and direct process APIs are outside the boundary.

rampart wrap -- aider                           # Enforce mode
rampart wrap --mode monitor -- agent            # Audit only
rampart wrap --config policy.yaml -- agent      # Custom policy

rampart preload¶

Add exec-family interception to supported dynamically linked processes via LD_PRELOAD or DYLD_INSERT_LIBRARIES.

Current release archives and Homebrew packages contain the CLI only. Build the matching native library from a Rampart source checkout with make -C preload install before using this command.

rampart preload -- your-agent                   # Enforce mode
rampart preload --mode monitor -- agent         # Audit only
rampart preload --debug -- agent                # Debug to stderr

rampart mcp¶

Proxy MCP servers with policy enforcement.

rampart mcp -- npx @mcp/server-fs .             # Enforce mode
rampart mcp --mode monitor -- server            # Audit only
rampart mcp scan -- <server>                     # Disabled; exits 1 with migration guidance

rampart init¶

Initialize a policy file.

rampart init                          # Standard profile
rampart init --profile paranoid       # Paranoid profile
rampart init --profile yolo           # Yolo profile
rampart init --profile mcp-server     # Static MCP starter policy
rampart init --detect                 # Auto-detect environment

rampart init --from-audit¶

Generate policy YAML from audit logs. Observe what your agent does in monitor mode, then generate allow rules to match the observed behavior.

rampart init --from-audit ~/.rampart/audit/audit.jsonl          # Generate from audit log
rampart init --from-audit ~/.rampart/audit/ --since 24h         # Last 24 hours only
rampart init --from-audit ~/.rampart/audit/ --dry-run           # Preview without writing
rampart init --from-audit ~/.rampart/audit/ --output policy.yaml  # Custom output path

Only allowed events are used for rule generation — denied events represent behavior you don't want to codify.

Service Management¶

rampart serve install¶

Install rampart serve as a persistent system service. On macOS, creates a LaunchAgent plist. On Linux, creates a systemd user service (rampart-serve.service). Not supported on Windows.

Package-manager installs use a stable executable symlink only after Rampart verifies that it resolves to the currently running binary. This keeps the service valid across Homebrew upgrades without trusting an unrelated PATH entry.

rampart serve install                         # Install with defaults (port 9090)
rampart serve install --port 8080             # Custom port
rampart serve install --mode monitor          # Audit-only mode
rampart serve install --config-dir ~/.rampart/policies  # Custom policy directory
rampart serve install --audit-dir /var/log/rampart      # Custom audit directory
rampart serve install --approval-timeout 30m  # Custom approval timeout
rampart serve install --token mytoken         # Use a specific token
rampart serve install --force                 # Overwrite existing installation

The token is saved to ~/.rampart/token and embedded in the service file (mode 0600). Hooks read it automatically.

rampart serve stop¶

Stop a rampart serve process that was started with --background. Rampart authenticates the PID from ~/.rampart/serve.pid before terminating the process with the platform-appropriate mechanism.

rampart serve stop

rampart serve uninstall¶

Remove the rampart serve system service. On macOS, unloads and removes the LaunchAgent plist. On Linux, disables and removes the systemd user service and runs daemon-reload.

rampart serve uninstall

Diagnostics¶

rampart doctor¶

Health check — verifies installation, policies, server, hooks, audit trail, and system info.

rampart doctor

For automation, rampart doctor --json emits schema rampart.doctor.v1 with top-level fields: schema_version, generated_at, build_version, summary, checks, numeric warnings/issues, and warning_checks/issue_checks arrays.

When the OpenClaw native plugin is installed, doctor shows:

✓ OpenClaw plugin: installed (before_tool_call hook active)

If the plugin is missing or the OpenClaw version is too old:

✗ OpenClaw plugin: not installed
  → Run: rampart protect openclaw

rampart status¶

Quick dashboard showing configured agents, the strongest current verification evidence, policy-service mode, and today's event counts.

rampart status
rampart status --json      # Machine-readable snapshot

--json emits a stable status payload (schema_version: "rampart.status.v1") with mode, the backward-compatible protected_agents list, per-integration integrations evidence, server flags, today's counts, and optional last deny details. Assurance levels distinguish detected, configured, adapter_verified, host_verified, unverified, and degraded; stale receipts fall back to current configuration state and explain why proof must be rerun. Service-backed receipts cannot establish the current service instance, build, or enforcement mode. Their evidence remains historical and status falls back to detected/configured until runtime association is supported. A reachable daemon alone does not promote that evidence.

mode comes from the configured service's health response and is unknown when that service cannot be reached or identified. Local hook enforcement can still operate without a service; this field does not infer each hook's mode. The separate default_action describes local policy configuration. An allow-by-default policy can actively deny matching requests and does not imply monitor mode.

rampart inventory¶

Local observability snapshot for automation and debugging.

Use --json for a stable machine-readable contract (rampart.inventory.v1) that includes protected agents, policy file load status, audit footprint, and local rampart serve reachability.

rampart inventory
rampart inventory --json

rampart test¶

Dry-run commands against your policies or run a declarative test suite.

Single command:

rampart test "rm -rf /"                  # Test an exec command
rampart test --tool read "/etc/passwd"   # Test a file read
rampart test --tool write "/etc/hosts"   # Test a file write
rampart test --config custom.yaml "cmd"  # Test with specific policy

Test suite (YAML file):

rampart test tests.yaml                  # Run all test cases
rampart test tests.yaml --verbose        # Show match details
rampart test tests.yaml --json           # Machine-readable output
rampart test tests.yaml --run "deny*"    # Filter by name glob
rampart test                             # Auto-discover rampart-tests.yaml

Test suite format:

tests:
  - name: deny rm -rf
    tool: exec
    params:
      command: "rm -rf /"
    expect: deny
    expect_message: "Destructive*"    # optional glob match on message

  - name: allow git push
    tool: exec
    params:
      command: "git push origin main"
    expect: allow

  - name: deny SSH key read
    tool: read
    params:
      path: "~/.ssh/id_rsa"
    expect: deny

Tests can also be embedded directly in a policy file under a tests: key. See examples/policy-with-tests.yaml for a self-verifying policy.

Flags:

Exit code 0 if all tests pass, 1 if any fail. Designed for CI pipelines.

Monitoring¶

rampart log¶

Pretty-print recent audit events.

rampart log                   # Last 20 events
rampart log -n 50             # Last 50
rampart log --deny            # Only denies
rampart log --today           # Today only
rampart log --json            # Raw JSON output

rampart watch¶

Live terminal dashboard showing decisions in real time.

rampart watch

rampart report¶

Generate an HTML audit report.

rampart report

Audit¶

rampart audit tail¶

View recent audit events.

rampart audit tail                    # Last events
rampart audit tail --follow           # Stream live

rampart audit verify¶

Check hash chain integrity.

rampart audit verify

rampart audit witness¶

Experimental. Publish a checkpoint or retrieve retained evidence using an operator-owned witness configuration. The destination must be independently administered; Rampart does not install or operate a witness service.

rampart audit witness publish --config /etc/rampart/witness.json
rampart audit witness status --config /etc/rampart/witness.json
rampart audit verify --require-witness --witness-config /etc/rampart/witness.json

Missing, stale or invalid required evidence fails verification. See External Witnessing for deployment, identity, retention, transport and unwitnessed-tail limits.

rampart audit stats¶

Show decision breakdown.

rampart audit stats

rampart audit search¶

Query the audit trail.

rampart audit search <query>                     # Search events by text
rampart audit search --tool exec --decision deny # Search with filters
rampart audit search --agent claude-code "cmd"   # Search by agent

rampart audit replay¶

Replay audit events with timing.

rampart audit replay                  # Replay with original timing
rampart audit replay --speed 2.0      # Replay at 2x speed  
rampart audit replay --speed 0        # Replay instantly (no delays)

Policy Customization¶

rampart allow¶

Add an allow rule to your override policy without editing YAML.

rampart allow "npm install *"                  # Auto-detect tool type
rampart allow "go test ./..."                  # Commands with ./ detected as exec
rampart allow "/tmp/**" --tool read            # Explicit tool type
rampart allow "docker build *" --global        # Write to global overrides
rampart block "pytest *" --project             # Write a restriction to project policy
rampart allow "git push *" --yes               # Skip confirmation
rampart allow "docker *" --for 1h              # Expires after 1 hour
rampart allow "npm publish" --once             # Single-use — consumed after first match

--for accepts Go duration strings (1h, 30m, 24h, 2h30m). Expired rules are automatically skipped during evaluation and cleaned up periodically by rampart serve. --once creates a single-use rule: after its first match, Rampart removes it from the policy file and reloads. This works in both rampart serve (proxy) and rampart hook (Claude Code) modes.

rampart block¶

Add a deny rule to your override policy.

rampart block "rm -rf /*"                      # Block dangerous command
rampart block "curl * | bash" --global         # Global deny rule
rampart block "**/.env" --tool read            # Block reading .env files

rampart rules¶

List, remove, and reset override rules added via allow/block.

rampart rules                                  # List all override rules
rampart rules --global                         # List only global rules
rampart rules --project                        # List only project rules
rampart rules --json                           # JSON output for scripting
rampart rules remove 1                         # Remove rule by index
rampart rules reset                            # Remove all override rules
rampart rules reset --global                   # Reset only global rules

rampart policy generate preset¶

Generate a policy from a preset template.

rampart policy generate preset                         # Interactive wizard
rampart policy generate preset --preset coding-agent   # Select preset
rampart policy generate preset --preset ci-agent --dest .rampart/policy.yaml
rampart policy generate preset --preset devops-agent --print   # Print to stdout

Available presets:

Policy Inspection¶

rampart policy check¶

Validate YAML policy files.

rampart policy check

rampart policy explain¶

Trace how a command would be evaluated, including matching policy source files, scope, winning rule, and why the final decision won. Durable user overrides from user-overrides.yaml are labeled explicitly.

rampart policy explain "rm -rf /"
rampart policy explain --tool exec --agent openclaw --session discord/direct/main "git status"
rampart policy explain --config ~/.rampart/policies/user-overrides.yaml "sudo true"

rampart policy test¶

Alias for rampart test. Evaluate one command, or run a YAML test suite against your policies.

rampart policy test "rm -rf /"
rampart policy test tests.yaml
rampart policy test --run "blocks-*" --verbose tests.yaml

Policy Management¶

Commands for linting, discovering, and managing policy profiles from the Rampart registry.

rampart policy lint <file>¶

Lint a policy YAML file for errors, warnings, and suggestions. Checks for invalid YAML syntax, unknown action/condition values (with typo suggestions), rules with no conditions, excessive glob depth, common field confusion, shadowed rules, and missing default_action.

rampart policy lint policy.yaml
rampart policy lint ~/.rampart/policies/user-overrides.yaml

Exit code 1 if errors are found; 0 if only warnings or info.

rampart policy list¶

List all available policy profiles — both built-in profiles and community policies from the Rampart registry. Uses a local cache (TTL: 1 hour) and falls back to embedded data when offline.

rampart policy list                    # List all profiles
rampart policy list --extended         # Show SOURCE and INSTALLED columns
rampart policy list --refresh          # Force refresh registry cache
rampart policy list --json             # JSON output

rampart policy search <query>¶

Search community policies in the registry by name, description, or tag. Results are sorted by bench score (descending).

rampart policy search docker                     # Search for docker-related policies
rampart policy search "prompt injection"         # Multi-word search
rampart policy search ci --tag ci                # Filter by exact tag
rampart policy search security --min-score 80   # Minimum bench score
rampart policy search docker --json              # JSON output

rampart policy show <name>¶

Print the full YAML of a built-in profile or community policy without installing it.

rampart policy show standard
rampart policy show paranoid
rampart policy show docker-restricted

rampart policy fetch <name>¶

Download and install a community policy profile to ~/.rampart/policies/<name>.yaml. Verifies the SHA256 checksum before writing. Falls back to the embedded policy copy when the registry is unreachable.

rampart policy fetch docker-restricted          # Install a community policy
rampart policy fetch docker-restricted --force  # Overwrite if already installed
rampart policy fetch docker-restricted --dry-run  # Preview install path

rampart policy install <name>¶

Alias for rampart policy fetch. Downloads and installs a community policy profile.

rampart policy install docker-restricted
rampart policy install docker-restricted --force
rampart policy install docker-restricted --dry-run

rampart policy remove <name>¶

Remove an installed community policy profile from ~/.rampart/policies/. Built-in profiles (standard, paranoid, yolo, etc.) cannot be removed.

rampart policy remove docker-restricted

rampart policy sync <git-url>¶

Sync a Rampart policy from a git repository. Requires git in PATH and an HTTPS URL pointing to a publicly accessible repo. Looks for rampart.yaml, policy.yaml, or .rampart/policy.yaml in the repo root. Writes the result to ~/.rampart/policies/org-sync.yaml and persists state to ~/.rampart/sync-state.json.

rampart policy sync https://github.com/myorg/policies   # One-shot sync
rampart policy sync https://github.com/myorg/policies --watch           # Poll for updates
rampart policy sync https://github.com/myorg/policies --watch --interval 10m  # Custom interval
rampart policy sync                                      # Re-use previously saved URL

rampart policy sync status¶

Show the current sync configuration and last sync result.

rampart policy sync status

rampart policy sync stop¶

Remove the configured sync URL, stopping future syncs.

rampart policy sync stop

rampart pending¶

List commands waiting for human approval.

rampart pending

rampart approve¶

Approve a pending command.

rampart approve <id>

rampart deny¶

Deny a pending command.

rampart deny <id>

Token¶

rampart token¶

Top-level command for managing authentication tokens. Without a subcommand, shows help. Use rampart token show to print the current admin token.

rampart token show¶

Print the current admin bearer token (read from ~/.rampart/token).

rampart token show

rampart token rotate¶

Generate and persist a new admin bearer token. Prompts for confirmation unless --force is given.

rampart token rotate
rampart token rotate --force

Token Management¶

Per-agent tokens let you issue scoped tokens for individual agents with different policy enforcement levels. Agent tokens are eval-only by default — they can submit tool calls but cannot approve requests or modify policies.

rampart token create¶

Create a new per-agent token. The full token is printed once at creation — save it, as it cannot be retrieved later.

rampart token create --agent codex
rampart token create --agent codex --policy paranoid --note "CI pipeline"
rampart token create --agent claude-code --expires 30d
rampart token create --agent admin-bot --scope eval --scope admin
rampart token create --agent codex --json

rampart token list¶

List all per-agent tokens. Token values are masked — only the ID prefix is shown.

rampart token list
rampart token list --json

rampart token revoke <token-id-or-prefix>¶

Revoke a per-agent token by its ID or ID prefix. Revoked tokens are rejected immediately by the proxy.

rampart token revoke abc123
rampart token revoke abc                  # Revoke by prefix (must be unambiguous)

rampart token info <token-id-or-prefix>¶

Show full details for a per-agent token.

rampart token info abc123