secure-agent

What problem does it solve?

Prevents AI agents from bypassing Earl by blocking direct CLI/HTTP access and restricting outbound network destinations, turning advisory guidance into enforceable platform-level controls.

Core Features & Use Cases

• Generate deniedTools: Produce a denylist of common CLI tools (curl, gh, stripe, etc.) based on installed Earl templates to block accidental or habitual direct API/CLI use.
• Apply and merge safely: Merge deniedTools into platform configs (for example, .claude/settings.json) without overwriting unrelated settings and avoid duplicate entries.
• Egress controls: Create network.allow entries in Earl's config to restrict which hosts templates may contact and verify with earl doctor and a denied-command test.
• Use Case: Lock down a Claude Code agent so it can only call services through Earl templates and cannot use curl or gh to reach external APIs directly.

Quick Start

Apply secure-agent to generate a proposed deniedTools array and corresponding Earl network.allow rules from your current templates and prompt me for approval before applying them.