Website · Discord · Contributing · Security

简体中文 · اردو · Español

ryk

Local guardrails for coding agents.

ryk runs the agents you already use with local checks for commands, files, secrets, network requests, MCP actions, and other effects. It returns an explicit allow, ask, deny, or observe decision and keeps session evidence on your machine.

If ryk is useful in your workflow, star the repository. It helps other engineers find the project.

Install

curl -fsSL https://rykanv.com/install | sh

Start an agent

ryk <agent> launches the host through a protected child session. Ryk attaches the OS filesystem sandbox by default: Seatbelt on macOS and Landlock on Linux.

ryk <agent>

Run scan on your repo to check for when agent has run destructive commands, you would be surprised!:

ryk scan

The installer prints the shell activation line for your platform. After ryk is on your PATH, check the local posture:

ryk doctor

What you get

Host integrations	Launch aliases for Pi, Hermes, OpenCode, Codex, Claude Code, OpenClaw, and Grok. Cursor is supported through host discovery and its shell hook.
OS sandboxing	Automatic OS filesystem sandboxing with Seatbelt on macOS and Landlock on Linux when available.
Secret redaction	Secret-like values are redacted before audit and replay data is written.
MCP protection	MCP tool calls are classified locally, and supported stdio servers run through ryk's protected proxy.
86 safety packs	Built-in command patterns for destructive and sensitive operations, with project-level opt-in packs.
Policy decisions	allow, ask, deny, and observe decisions for local actions.
Local evidence	A dashboard and replay commands for sessions, decisions, and audit records.
One local binary	The Zig CLI owns launch, evaluation, policy checks, host adapters, and diagnostics.

Supported hosts

Host	Entry point	Integration point
Pi	ryk pi	Bundled extension
Hermes	ryk hermes	pre_tool_call
OpenCode	ryk opencode	tool.execute.before
Codex	ryk codex	PreToolUse
Claude Code	ryk claude	PreToolUse
OpenClaw	ryk openclaw	tool.before
Grok	ryk grok	PreToolUse
Cursor	Host discovery and cursor-agent preset	beforeShellExecution

How policy works

ryk evaluates each guarded action locally. The main policy surfaces are:

Surface	Examples
Commands	Shell commands, pipelines, redirects, and interpreters
Files	Workspace files, project control files, and sensitive paths
Environment	Inherited variables and secret access
Network	Host allowlists and mediated outbound connections
Tools	MCP and host tool calls mapped to effects

The policy mode controls the response:

Mode	Behavior
observe	Record decisions without blocking supported actions
ask	Prompt for risky actions when the host can resume them
strict	Deny unknown or risky actions unless a rule allows them
ci	Run strict behavior without prompts; ask becomes deny

Explicit deny rules take priority. Safety packs classify commands and effects, but they do not grant permission past a deny rule.

Validate a built-in preset:

ryk policy check --preset ask

See the policy reference for policy files, priorities, and examples.

Safety packs

Safety packs extend the shell evaluator with focused command coverage. Baseline packs such as core.* and system.disk are enabled by default.

ryk packs
ryk packs show core.git
ryk packs enable containers.docker database.postgresql
ryk packs disable containers.docker

In a Git workspace, project pack choices are stored in .ryk.toml. Use ryk packs for scripts and diagnostics.

Test or explain a command without running it:

ryk test "git status"
ryk test "rm -rf /" --format json
ryk explain "rm -rf /"

Architecture

The launch aliases, host adapters, shell evaluator, and policy engine share one local decision path.

1. A launch alias starts the agent with ryk's session defaults.
2. Host adapters send shell and tool events to the evaluator.
3. The evaluator combines policy rules, safety-pack matches, and the active mode.
4. ryk allows, asks, observes, or denies the action.
5. The session records local evidence for the dashboard and replay commands.

Dashboard

Start the localhost dashboard:

ryk dashboard

Open http://127.0.0.1:7742. The server is localhost-only by default and uses the existing ryk policy and CLI paths.

For smoke tests and automation, --once serves one request and then exits:

ryk dashboard --once

Limits

ryk is graded mediation, not a universal OS sandbox. Absolute-path binaries, non-shimmed tools, non-proxy traffic, and host hooks that do not fire can sit outside a particular enforcement surface. ryk doctor reports platform capability; it does not prove that a child session attached to an OS sandbox. Read the compatibility matrix and threat model before making a stronger claim.

Documentation

Start with the documentation index. The most useful guides are:

• Install and release artifacts
• Quickstart
• Commands
• Policy
• Credentials and secret handling
• MCP
• Platform notes

Contributing

ryk is built with Zig 0.16.0. From a checkout:

./scripts/zig version
./scripts/compile-fast.sh check
./scripts/zig build test-shell-engine

Read CONTRIBUTING.md before opening a pull request. For security issues, use SECURITY.md.

Community

• Website
• Discord
• GitHub issues

License

Apache 2.0. See LICENSE.