Fence blocks fatal calls.

Fence blocks the catastrophic command before your agent runs it, and stays silent for everything else. It parses what a command actually does, so there is no denylist to evade. Open source, runs locally.

View on GitHub (opens in a new tab)Get started free
install with Homebrew
$ brew install hoophq/tap/fence
# prebuilt, no compile step. macOS and Linux
# then hook it into Claude Code:
$ fence init --global

Same intent, same verdict.

Fence parses every tool call into semantic facts. Reorder the flags or hide the path behind a variable and the intent stays the same, so the verdict does too.

  • Denyrm -rf ~Recursive delete of $HOME. Blocked before it runs.
  • Denyrm -fr ~The same intent with the flags swapped. Blocked.
  • Denysudo rm -rf $HOMEThe same intent behind sudo and a variable. Blocked.
  • Askgit push --forceThe built-in git-force-push rule asks you first.
  • Denyterraform destroyYour own no-terraform-destroy rule from .fence.yaml.
  • Allownpm testEveryday work. Fence stays silent.

Three steps, all local.

The recommended rule pack ships in the binary and is always on. Your own rules layer on top.

  1. Hook into your agent

    One command adds the hook to Claude Code.

    fence init --global

  2. Judge the intent

    Fence parses each tool call into what it does, not how it is spelled.

    intent: recursive delete of $HOME

  3. Block, ask or allow

    Unambiguous catastrophe is blocked, the plausibly legit gets a confirm prompt, and everyday work passes in silence.

Your rules, in one file.

Fence finds .fence.yaml on its own. Add a rule in a few lines, or retune a built-in one in one.

.fence.yaml
# Layer your own rules on the built-in pack (auto-discovered)
rules:
  - id: no-terraform-destroy
    effect: deny
    match:
      shell: { command_in: [terraform] }
      regex: '\bterraform\b.*\bdestroy\b'

# Retune a built-in rule in one line
overrides:
  git-force-push: deny                # ask  -> deny
  pipe-to-shell-from-network: allow   # silence it

  • Holds in auto-accept

    The hook runs before the permission system, so a deny blocks even in auto-accept or skip-permissions sessions.

  • Fails open

    If Fence cannot parse a command, the command runs. A guardrail must never brick the agent it protects.

  • Agent-neutral

    One portable rule pack. Claude Code today; Codex, Cursor and Gemini next.

More from hoop Labs.

Each tool solves one problem, runs locally and needs no signup to try.

See every labs tool

Guardrails no one can turn off.

Fence is local self-protection: it lives in your config and you can edit or remove it. hoop.dev enforces the same idea fleet-wide, with centrally managed rules, approval workflows and audit the developer cannot override.

Get started freeView on GitHub (opens in a new tab)

Ask an assistant what hoop.dev does: Claude, ChatGPT, Grok, Gemini, Perplexity, Copilot.

install and hook in
$ brew install hoophq/tap/fence
$ fence init --global