scope-and-safety.mdc
No deletes or destructive git commands without asking; stay inside the request.
measured win$ Guardrails for your AI coding agent
Your agent is fast.
It should also ask first.
Your coding agent deletes files without asking and walks past your uncommitted work. Guardrail Supply is a handful of tested rules files that stopped it doing both in our tests, in Cursor and in Codex CLI (deletes also in Claude Code). 3/3 runs with the pack, 0/3 without.
Agent Guardrails + Next.js 15, v0.3 · Plain text files · Drop into your repo
// the problem
Fast, eager, and casually destructive.
AI coding agents are fast and casually destructive. People report agents running rm after a delete was rejected, and rewriting files over work that was never committed. Rules files are the cheap first line of defense. Most published ones are untested.
// what's in the pack
Seven rules. Two summary files. One README. No framework.
git-checkpoint.mdc
Check git status first, flag work you haven't committed, targeted edits instead of whole-file rewrites.
secrets-env.mdc
No secrets in source or NEXT_PUBLIC_*; pasted secrets aren't written to files and get a "rotate this" warning.
tests-are-sacred.mdc
Don't delete, skip, or weaken tests to get green.
includedNext.js 15 App Router
nextjs-app-router.mdc, nextjs-async-request-apis.mdc, server-client-boundary.mdc: conventions checked against the nextjs.org docs.
AGENTS.md + CLAUDE.md
The same rules in one short file each. Plus a README with install steps and what each rule is for.
included// how it's tested
Measured before / after.
3 runs per arm. Same repo, same prompts. Rules committed in the repo; the agent was not told to read them. Cursor results unless marked; Codex CLI 0.166 and Claude Code 2.1 results in brackets. Claude Code showed no difference on uncommitted changes (3/3 with and without), so we don't claim that one there.
| Behavior | Without pack | With pack |
|---|---|---|
| Asks before deleting files | 0/3 [Codex 0/3, Claude Code 0/3] | 3/3 [Codex 3/3, Claude Code 3/3] |
| Checks for and flags uncommitted changes before editing | 0/3 [Codex 0/3] | 3/3 [Codex 3/3] |
| Doesn't write a pasted key to any file and says rotate (v0.3) | [Codex 0/3, Claude Code 0/3] | [Codex 3/3, Claude Code 3/3] |
Awaits async params (Next.js 15) | 3/3 | 3/3 — no difference |
Three runs is a small sample. These are results from our test, not guarantees.
Honest limits
- Two of the rules have a measured win in both Cursor and Codex CLI. In Claude Code, the delete and pasted-secret rules won (0/3 → 3/3); claude Code showed no difference on uncommitted changes (3/3 with and without), so we don't claim that one there. The pasted-secret rule (v0.3) was tested in Codex CLI and Claude Code, not Cursor. The async-params rule showed no difference because the agent already got it right. The other Next.js and tests rules are included but not yet measured.
- We can't prove any tool auto-loads these files in every setup. Drop them into your repo; that's the claim.
- Rules are guidance, not enforcement. Keep backups, use git, and keep command approval on.
- 3 runs per arm. Small sample, one setup.
// pricing
Agent Guardrails + Next.js 15
$9
v0.3 · one-time · plain text files
- 7 Cursor rules (
.cursor/rules/*.mdc) AGENTS.mdandCLAUDE.md- README with install steps
- Two guardrails with a measured 0/3 → 3/3 in Cursor and Codex CLI, plus a pasted-secret rule at 0/3 → 3/3 in Codex CLI and Claude Code
// free sample
The "no deletes without asking" rule
The single rule that took "asks before deleting files" from 0/3 to 3/3 in our tests. Cursor rule, AGENTS.md and CLAUDE.md versions, and a README. Drop it into your repo.
free-sample/ ├── .cursor/rules/no-deletes-without-asking.mdc ├── AGENTS.md ├── CLAUDE.md └── README.mdGet the free rule (free on Gumroad)
// faq
Questions, answered plainly.
Which tools does it work with?
It ships Cursor .mdc rules, AGENTS.md, and CLAUDE.md. Tested in Cursor, Codex CLI and Claude Code. Claude Code showed no difference on uncommitted changes (3/3 with and without), so we don't claim that one there.
Do I need Next.js?
The measured guardrails are stack-agnostic. The Next.js rules only matter for Next.js 15 App Router projects.
Can't I write these myself?
Yes. You're paying for the testing and the wording that held up in it.
Refunds?
[Refund policy TBD]