Runwall

Runtime security guardrails for Claude Code, Codex, and MCP-based coding setups.

Runwall sits between the agent and risky actions so you can:

• block obvious bad shell, git, MCP, and exfiltration flows
• scan a repo or runtime setup before enabling it
• keep a practical security baseline without turning normal coding into sludge

Coding agents can:

• run shell commands
• edit files
• push git changes
• call MCP tools
• touch secrets, browsers, databases, and local services

That is useful, but it is also enough to leak data or damage a machine fast.

Runwall helps reduce that risk with:

• preflight checks before risky actions run
• output inspection after tools return untrusted content
• local trust tracking for tools, hooks, data stores, IPC targets, and approvals
• installable profiles: minimal, balanced, and strict

claude plugin marketplace add efij/secure-claude-code
claude plugin install runwall@runwall
claude plugin list

Expected result:

• runwall@runwall
• Status: enabled

If your Codex supports local bundle install, install this repo as a plugin bundle.

Fallback:

./bin/runwall generate-runtime-config codex balanced

git clone https://github.com/efij/secure-claude-code.git
cd secure-claude-code
./bin/runwall install balanced
./bin/runwall doctor

• minimal: lowest friction
• balanced: sensible default
• strict: strongest blocking and review prompts

• shell execution
• git and repo actions
• MCP requests and responses
• plugin and skill trust boundaries
• secrets and local credential stores
• local services, IPC, and browser sessions
• destructive actions and production access

./bin/runwall install balanced
./bin/runwall doctor
./bin/runwall audit .
./bin/runwall list protections
./bin/runwall list runtimes
./bin/runwall generate-runtime-config codex balanced
./bin/runwall generate-runtime-config cursor balanced
./bin/runwall generate-runtime-config windsurf balanced
./bin/runwall generate-runtime-config claude-desktop balanced

./bin/runwall tools list --json
./bin/runwall tools approve <name-or-path>
./bin/runwall hooks list --json
./bin/runwall hooks diff <path-or-key>
./bin/runwall approvals list --json
./bin/runwall services list --json
./bin/runwall data list --json
./bin/runwall ipc list --json
./bin/runwall browser sessions --json
./bin/runwall flow list --json
./bin/runwall agents graph --json
./bin/runwall memory list --json
./bin/runwall knowledge list --json
./bin/runwall review list --json
./bin/runwall artifacts list --json
./bin/runwall release list --json
./bin/runwall destructive list --json
./bin/runwall handoff graph --json
./bin/runwall auth list --json
./bin/runwall apps list --json
./bin/runwall safety list --json

More detail: RUNTIMES.md

If you want to inspect before enabling:

./bin/runwall audit .
./bin/runwall audit . --format html --output runwall-audit.html
./bin/runwall audit . --format sarif --output runwall-audit.sarif

Run:

claude plugin uninstall runwall@runwall
claude plugin marketplace remove runwall
claude plugin marketplace add efij/secure-claude-code
claude plugin install runwall@runwall
claude plugin list

You want:

• Status: enabled

If GitHub still serves an older broken marketplace state, install from a local checkout until the fix is pushed:

cd ..
git clone https://github.com/efij/secure-claude-code.git
claude plugin marketplace add ./secure-claude-code
claude plugin install runwall@runwall

Run the local smoke checks:

bash tests/smoke.sh

If you only want the quick sanity path:

bash -n bin/shield install.sh update.sh uninstall.sh hooks/lib/patterns.sh tests/smoke.sh
python3 -m py_compile scripts/runwall_tools.py
./bin/runwall generate-plugin-hooks balanced /tmp/runwall-hooks.json
claude plugin validate .

curl -fsSL https://raw.githubusercontent.com/efij/secure-claude-code/main/scripts/bootstrap.sh | bash -s -- --repo efij/secure-claude-code --ref main --profile balanced

irm https://raw.githubusercontent.com/efij/secure-claude-code/main/scripts/bootstrap.ps1 | iex; Install-Runwall -Repo "efij/secure-claude-code" -Ref "main" -Profile "balanced"

• GUARDS.md: guard inventory
• RUNTIMES.md: runtime adapters
• SECURITY_MODEL.md: model and assumptions
• CHANGELOG.md: release notes
• CONTRIBUTING.md: contributor notes

MIT