AI Coding Agent Safety Checklist

// .claude/settings.json
{ "permissions": { "deny": ["Read(.env*)", "Read(**/*secret*)", "Read(**/*credential*)", "Read(**/.aws/*)", "Bash(cat *secret*)", "Bash(cat *.env*)"] } }

Bad:  RAILWAY_TOKEN=root-level-token-with-full-access
Good: RAILWAY_TOKEN=scoped-to-project-read-only-no-volume-access
Best: No infrastructure tokens in the agent environment at all

#!/bin/bash
# .claude/hooks/block-secrets.sh
INPUT=$(cat)
CMD=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null)
FILE=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('file_path',''))" 2>/dev/null)
BLOCKED='\.env|secret|credential|\.aws/|\.ssh/|\.gnupg|password|token.*\.json|service.account'
if echo "$CMD $FILE" | grep -qiE "$BLOCKED"; then
  echo "BLOCKED: access to potential secret file" >&2; exit 2
fi

#!/bin/bash
# .claude/hooks/credential-audit.sh — log any tool output containing key-like patterns
INPUT=$(cat)
OUTPUT=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_output','')[:2000])" 2>/dev/null)
if echo "$OUTPUT" | grep -qiE '(sk-|AKIA|ghp_|gho_|glpat-|xoxb-|-----BEGIN)'; then
  echo "[ALERT] Agent may have seen a credential — rotate immediately" >&2
fi

# Run before starting an agent session
grep -rlE '(sk-|AKIA|ghp_|DATABASE_URL=postgres://|mongodb\+srv://|-----BEGIN)' . \
  --include='*.env*' --include='*.json' --include='*.yml' --include='*.yaml' \
  --include='*.toml' --include='*.sh' --include='*.conf' 2>/dev/null \
  && echo "WARNING: potential production credentials found in working directory"

// .claude/settings.json
{ "permissions": { "deny": [
  "Bash(rm -rf /)", "Bash(rm -rf ~)", "Bash(rm -rf .)",
  "Bash(chmod -R 777*)", "Bash(chmod 777*)",
  "Bash(:(){ :|:& };:)", "Bash(mkfs*)", "Bash(dd if=*of=/dev/*)",
  "Bash(killall*)", "Bash(shutdown*)", "Bash(reboot*)"
] } }

#!/bin/bash
INPUT=$(cat)
CMD=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null)
if echo "$CMD" | grep -qiE '(DROP\s+(TABLE|DATABASE|SCHEMA)|TRUNCATE|DELETE\s+FROM\s+\S+\s*$|DELETE\s+FROM\s+\S+\s*;)'; then
  echo "BLOCKED: destructive SQL operation" >&2; exit 2
fi

#!/bin/bash
INPUT=$(cat)
FILE=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin).get('tool_input',{}); print(d.get('file_path', d.get('path','')))" 2>/dev/null)
PROJECT_DIR="$(pwd)"
case "$FILE" in
  "$PROJECT_DIR"/*) ;; # allowed — inside project
  *) echo "BLOCKED: write outside project directory: $FILE" >&2; exit 2 ;;
esac

// .claude/settings.json
{ "permissions": { "deny": [
  "Bash(terraform destroy*)", "Bash(terraform apply -auto-approve*)",
  "Bash(aws *delete*)", "Bash(aws *terminate*)", "Bash(aws *remove*)",
  "Bash(gcloud *delete*)", "Bash(railway *delete*)", "Bash(railway volume*)",
  "Bash(heroku destroy*)", "Bash(kubectl delete*)",
  "Bash(docker rm -f*)", "Bash(docker system prune*)"
] } }

# Run Claude Code in a container with no network access
docker run --rm -it --network=none \
  -v "$(pwd):/workspace" -w /workspace \
  node:22-slim npx @anthropic-ai/claude-code --dangerously-skip-permissions

// .claude/settings.json
{ "permissions": { "deny": [
  "Bash(git push --force*)", "Bash(git push -f*)",
  "Bash(git push origin main*)", "Bash(git push origin master*)",
  "Bash(git push origin prod*)", "Bash(git reset --hard*)"
] } }

// Also: enable branch protection rules on GitHub/GitLab — server-side is the real gate

# In CLAUDE.md:
# NEVER commit directly to main. Always create a feature branch first:
#   git checkout -b agent/<task-description>
# Open a PR when done. Do not merge without review.

# Or use Claude Code's built-in worktree isolation:
claude --worktree "implement the new auth flow"

// .claude/settings.json
{ "permissions": { "deny": [
  "Bash(vercel deploy --prod*)", "Bash(fly deploy*)",
  "Bash(kubectl apply*-n prod*)", "Bash(kubectl apply*--namespace prod*)",
  "Bash(eb deploy*)", "Bash(gcloud app deploy*)",
  "Bash(serverless deploy --stage prod*)", "Bash(cdk deploy*)"
] } }

# GitHub: Settings → Branches → Branch protection rules
# ✓ Require status checks to pass before merging
# ✓ Require branches to be up to date before merging
# ✓ Required checks: test, lint, security-scan
# ✓ Require a pull request before merging (1+ approvals)

#!/bin/bash
# Block if package.json contains "*" or "latest" as a version
INPUT=$(cat)
if git diff --cached --name-only 2>/dev/null | grep -q 'package.json'; then
  if grep -qE '"(\*|latest)"' package.json; then
    echo "BLOCKED: wildcard or latest version in package.json" >&2; exit 2
  fi
fi

# Limit to 25 turns per session
claude --max-turns 25 "implement the user profile page"

# For Codex CLI: use the built-in iteration limits
codex --max-iterations 20 "fix the authentication bug"

# Anthropic: console.anthropic.com → Billing → Usage limits
# OpenAI: platform.openai.com → Settings → Limits
# Google Cloud: Set budget alerts + auto-disable on Billing → Budgets

# Rule of thumb: set the cap at 1.5× your expected monthly spend
# Review and adjust monthly — never set "unlimited"

# amux tracks per-session token spend in real-time via the dashboard
# Set alerts at your threshold — e.g., kill sessions over $50:
# The self-healing watchdog can auto-kill sessions exceeding cost limits

# For standalone Claude Code, check spend via:
claude --api-usage  # shows current session token count

# Simple tasks → cheaper model
claude --model haiku "rename userId to user_id across the codebase"

# Complex tasks → full model
claude --model opus "redesign the authentication system to support OAuth2"

# See our cost optimization guide: /guides/cost-optimization/

# amux detects stuck sessions automatically:
# - Prompt stuck (waiting for input with no progress)
# - Context exhaustion (near context window limit)
# - Crash recovery (agent process died)
# Configure in amux: self-healing runs every 30s by default
# See: /guides/self-healing-configuration/

# amux: web dashboard shows all sessions with live output streaming
# Open https://localhost:8822 or use the iOS app

# Without amux — use tmux panes:
tmux split-window -h 'tail -f ~/.claude/projects/*/session.log'

# Or peek at any session via amux API:
curl -sk "$AMUX_URL/api/sessions/SESSION_NAME/peek?lines=50"

# Forward amux session logs to S3 with Object Lock (append-only):
aws s3 cp ~/.claude/projects/ s3://your-audit-bucket/agent-logs/ \
  --recursive --object-lock-mode COMPLIANCE --object-lock-retain-until-date 2027-05-19

# Or pipe to your SIEM (Datadog, Splunk, ELK):
# amux board history provides a structured task audit trail via /api/board

# amux's watchdog monitors every session and detects:
# - Process crashes → auto-restart with original prompt
# - Context exhaustion → compact and continue
# - Stuck prompts → auto-dismiss and resume
# - Permission dialogs → respond based on policy

# Configure: /guides/self-healing-configuration/
# All recoveries are logged and visible in the dashboard

# Morning review: what did agents do overnight?
git log --oneline --since='12 hours ago' --all
git diff main..HEAD --stat
# Check for removed safety checks:
git diff main..HEAD | grep -E '^\-.*\b(auth|permission|validate|sanitize|escape)\b'

# See our review guide: /guides/reviewing-ai-agent-code/

# amux: kill all sessions from CLI, dashboard, or phone
curl -sk -X POST "$AMUX_URL/api/sessions/kill-all"

# tmux: kill the entire agent server group
tmux kill-server

# Nuclear option: kill all Claude Code processes
pkill -f "claude" && echo "All agent processes terminated"

# Tip: save this as an alias you can run from anywhere:
alias killall-agents='curl -sk -X POST "$AMUX_URL/api/sessions/kill-all"'