Some context on why we built this: you might have seen the post earlier this week about someone building a file recovery tool after Claude Code rm -rf'd their Obsidian vault through a symlink. We had similar near-misses running our own agent swarm, agents curling cloud metadata endpoints, attempting path traversal, executing destructive commands during "cleanup" steps. We kept adding one-off guards and eventually realized this should be a proper library.
The main design choice was making it deterministic rather than using an LLM to review tool calls. An LLM guarding another LLM felt like asking the fox to guard the henhouse. Pattern matching is boring, but it's fast, predictable, and works offline.
Happy to hear about false positives, missing threat categories, or use cases where the rule set is too aggressive. That's the main thing we want to calibrate for v0.2.
We run 15 AI agents on a production server with full shell access. One of them tried to rm -rf a directory it shouldn't have touched. Another started curling cloud metadata endpoints. We wrote some hardcoded rules to catch the obvious stuff, then realized we were building the same safety layer everyone else will need too. So we extracted it into a library.Vigil is a deterministic rule engine...