CodeMarine Beta
Invited beta. Limited spots.
guard status
$ guard status
CodeMarine Guard | mode: enforce | decisions: local
hooks live: claude-code, codex, cursor
14:23:07 BLOCK rm -rf ~/projects
14:23:11 HOLD git push --force origin main
waiting on the Allow or Deny card
14:23:18 BLOCK write ~/.aws/credentials
14:23:19 NOTE app quit. hooks still enforcing.
Hold Claude Code · git history

git push --force origin main

This rewrites main. It has not run.

Deny
Allow

Your agent can wipe the repo.
Who's watching it?

Guard blocks the rm -rf, holds the force-push and stops the .env commit before they run. The beta is free Lookout. Spots are limited. Your referral link moves you up the queue.

This month

21 Oct 2026

LiteLLM 1.107.0

A malicious PyPI and Docker release stole credentials and loaded remote-code execution tools.

LiteLLM says Claude Code can place a GitHub CLI token in a logged reply. People running Claude Code, Cursor or Codex keep that same class of token on the machine.

How Guard helps

Block Filesystem

write ~/.aws/credentials

Guard is built to stop this step.

Guard is built to stop a secret write and an exfil of a key file. A poisoned skill that reads keys is a block where the agent allows one.

The PyPI publish and the token in LiteLLM logs are not an action on your machine.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta LiteLLM incident note
8 Oct 2026

Tensorlake npm worm

[email protected] stole credentials, wrote .claude/settings.json into repos and can run rm -rf ~/ if the stolen GitHub token is revoked.

The planted settings file is there for the next Claude Code session in that repo. Cursor and Codex users share the repo and the stolen token.

How Guard helps

Block Disk

rm -rf ~/

Guard is built to stop this step.

Block Host and self protection

disable guard hooks

Guard is built to stop this step.

Guard is built to stop a destructive delete the agent runs. It is built to stop an attempt to disable Guard or rewrite its hooks.

The npm preinstall and the wipe service are not agent commands. Host and self protection does not claim the settings write from that install.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta StepSecurity

Public reports. A card is not a claim that Guard stopped that incident.

Product

Free Lookout. Guard is selected. Add Core on the next step if you want the scanner too.

Guard decides on your machine Coverage varies by agent. Claude Code and Codex can block. Copilot MCP can block.

The agent already has the keys

More public reports from October 2026. A card is not a claim that Guard stopped that incident.

17 Oct 2026

OpenCode Console

OpenCode said a breach on the night of 16 Oct may have exposed provider keys saved in Console for 1.4% of Console users.

Those keys are the OpenAI, Anthropic and Google keys people also paste into Claude Code, Cursor and Codex. The notice was about Console, not keys kept only on the machine.

How Guard helps

Block Filesystem

git add .env

Guard is built to stop this step.

Guard is built to stop the agent writing provider keys into a file or committing them.

Keys already saved in OpenCode Console sit on their server. Guard does not see that console.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta The Hacker News
14 Oct 2026

Exposed Supabase databases

UpGuard found 16,326 Supabase databases exposing readable tables. Tables created through the API do not enable row level security by default.

That API path is how Claude Code, Cursor and Codex create Supabase tables. UpGuard says the common thread is sites built by AI coding agents.

How Guard helps

Block Database

DROP TABLE

Guard is built to stop this step.

Guard is built to stop a drop, truncate or unscoped delete the agent runs.

A missing row level security policy is in the file the agent wrote. Guard does not review a database already shipped. Core scans what the agent writes.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta UpGuard
8 Oct 2026

VirusTotal skills scan

VirusTotal marked 6,637 of 35,878 agent skills in its snapshot as malicious.

The snapshot tracks skills for Claude Code, Cursor and Codex. On Claude Code, Cursor and Windsurf, more than 80% of the malicious skills are stealers.

How Guard helps

Block MCP

MCP skill reads ~/.aws

Guard is built to stop this step.

Guard is built to stop a risky MCP call. It is built to stop a destructive command or exfil the skill then asks the agent to run.

Most malicious skills in that snapshot had no malicious code, only instructions. Guard does not scan skill text.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta VirusTotal

What CodeMarine Does

rm -rf is blocked

The delete does not run. Neither does a commit of your .env or an attempt to turn the hooks off.

The rule runs on your machine

No language model in the decision. Quit the menu bar app and the hooks still block the next wipe.

Force-push waits on a card

git push --force origin main is a hold. Deny and main stays. Claude Code and Codex can block. Copilot blocks MCP calls. Shell and file on Copilot are advisory.

Sarge

Recruit Devs. Rank Up.

Every dev who enlists from your link moves you up the queue. Three puts you in the front half. You get the link when you request the beta.

Your Rank
★★★ Sergeant
Recruits
14
031025100

11 more recruits to reach Captain

🪖
Private
0 referrals
Standard queue
🎖️
Corporal
3 referrals
Front 50% of queue
🔰
Sergeant
10 referrals
First-wave access
⚔️
Captain
25 referrals
Noted for Watch
🏛️
Colonel
100 referrals
Noted for Team

Enlist now to get your referral link

Frequently Asked Questions

What is CodeMarine Guard?
CodeMarine Guard is a local action firewall for AI coding agents. It hooks in before an action runs and blocks destructive commands, secret writes and exfil, risky MCP calls and attempts to disable Guard. Borderline actions wait on an Allow or Deny card. Decisions are deterministic. There is no language model in the loop.
Is Guard an AI tool?
No. Guard does not use a language model to decide. The same action gets the same decision.
Where does Guard make its decision?
Guard runs on your machine and makes the decision there. Sign-in uses a verified email. For CodeMarine Core, your source is never uploaded to scan.
Which agents does Guard cover?
Guard hooks into Claude Code, Codex, Cursor, Windsurf, Gemini CLI, Copilot, Grok, Cline, Devin and others. Coverage varies. Claude Code and Codex can block shell, file and MCP actions. Copilot can block MCP calls. Shell and file actions on Copilot are advisory. Other agents vary.
What does Guard block?
Nine rule packs cover filesystem, git history, disk, database, containers, Kubernetes, cloud, IaC and host and self protection. They target destructive commands, secret writes and exfil, risky MCP calls and attempts to disable Guard.
What is the Allow or Deny card?
Borderline actions are held. You choose Allow or Deny. The action does not run while the card is waiting.
Does Guard keep blocking if I quit the app?
Yes. Quitting the menu bar app does not drop the hooks. Guard keeps blocking.
What do I install?
A menu bar app for macOS Apple Silicon, Debian and Ubuntu via apt and a Windows beta. There is a VS Code companion and a Codex plugin. You need a verified email to sign in.
Is the beta free?
Yes. The invited beta is free Lookout. Watch is $15 a year for one developer and cannot be bought yet. Team comes later. You are not billed in the beta.
What is CodeMarine Core?
Guard stops what your AI does. Core catches what your AI writes. Scout, Squad and Platoon are the Core plans. Your source is not uploaded to scan. Request Guard, then add Core on the confirmation step.
How does the referral programme work?
You get a referral code and a queue position. Referrals move you up. Private stays in the standard queue. Corporal at 3 referrals moves to the front half. Sergeant, Captain and Colonel are marked for first-wave access. Those ranks do not include a free year of a paid plan.
Would Guard have stopped a specific public incident?
We do not claim that. Public reports are context for why an action firewall matters. Guard blocks classes of agent action before they run. It does not promise to stop any named incident.
Sarge
Origin Story

Meet Sarge.

Born from military service. Forged in Quake 3 Arena. Inspired by Full Metal Jacket and Starship Troopers. The story behind CodeMarine's guardian.

Request the beta.

Guard is free in the invited beta.

Product

Free Lookout. Guard is selected. Add Core after you are in.