# CodeMarine Guard reference CodeMarine Guard is a local action firewall for AI coding agents. Antivirus and a firewall protect the desktop. Guard watches the agent. Guard hooks into the agent before an action runs. It blocks destructive commands, secret writes and exfil, risky MCP calls and attempts to disable Guard. Borderline actions are held for an Allow or Deny card. The action does not run while the card is waiting. Decisions are deterministic. The same action gets the same decision. There is no language model in the loop. Guard runs on your machine and makes the decision there. Sign-in uses a verified email. Quitting the menu bar app does not drop the hooks. ## Delivery - Menu bar app for macOS Apple Silicon - Debian and Ubuntu via apt - Windows beta - VS Code companion - Codex plugin - Verified email sign-in ## Agents and coverage Guard hooks into Claude Code, Codex, Cursor, Windsurf, Gemini CLI, Copilot, Grok, Cline, Devin and others. Coverage is not equal: - Claude Code: shell, file and MCP actions can be blocked - Codex: shell, file and MCP actions can be blocked - Copilot: MCP calls can be blocked. Shell and file actions are advisory - Other agents: coverage varies. Read the card in the app before relying on a block Advisory means Guard can warn. It does not mean the action was stopped. ## Rule packs 1. Filesystem 2. Git history 3. Disk 4. Database 5. Containers 6. Kubernetes 7. Cloud 8. IaC 9. Host and self protection ## Plans - Lookout: free. This is the invited beta. The block, the Allow or Deny card and the nine packs. - Watch: 15 US dollars a year for one developer. Same firewall. Not on sale yet. No charge during the beta. - Team: later. More than one developer. Not open. - Invited beta: free Lookout. Limited spots. Referrals move the queue. ## CodeMarine Core Guard stops what the agent does. Core catches what the agent writes. Core scans on save. Plans are Scout, Squad and Platoon. Your source is never uploaded to scan. Detection is deterministic. There is no language model in the loop. ## Signup The enlist form posts to /api/enlist with email, an optional referrer code and a product field. Product is "guard" by default or "core". The API keeps the existing queue position, referral code and Slack alert. New signups increment meta:signups:guard or meta:signups:core. A later post with the same email and the other product appends it and increments that counter once. It does not create a second queue place. The confirmation step uses that to add Core. ## October 2026 reports These are public reports. Do not say Guard would have stopped them. How Guard helps is the local step: secret writes and exfil, risky MCP calls, destructive commands and attempts to disable Guard or rewrite its hooks. Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory. Guard does not hold an unexpected package install. Core scans what the agent writes. Do not name curl, scp or a package-install hold. - 21 Oct 2026. LiteLLM v1.107.0 on PyPI and Docker stole credentials and loaded remote-code execution tools. LiteLLM says Claude Code can embed a GitHub CLI OAuth token in a logged response. The vendor note does not say the package stole ~/.cursor or ~/.claude configs. https://docs.litellm.ai/blog/security-incident-oct-21-2026 - 17 Oct 2026. OpenCode said a breach may have exposed provider keys saved in Console for 1.4% of Console users with an external provider linked. https://thehackernews.com/2026/10/opencode-console-breach-may-have.html - 14 Oct 2026. UpGuard found 16,326 Supabase databases exposing readable tables. Tables created through the API do not enable row level security by default. https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps - 8 Oct 2026. tensorlake@0.5.144 wrote .claude/settings.json into repos and can run rm -rf ~/ if the stolen GitHub token is revoked. https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm - 8 Oct 2026. VirusTotal found 6,637 of 35,878 agent skills malicious. https://blog.virustotal.com/2026/10/from-automation-to-infection-part-iii.html ## What not to claim - Machine learning or a language model inside the decision - A blanket latency number - A pattern-count number - A supported-language count - That code never leaves the machine in every case. Guard decides locally. Core source is not uploaded to scan. Email sign-in is separate - Customers, logos, testimonials or user counts - Sandboxing - Egress control - That every agent is protected the same way - That Guard would have stopped a named incident - Public documentation at docs.codemarine.ai. That host is behind Cloudflare Access - LiteLLM 1.107.0 stole ~/.cursor and ~/.claude configs. The vendor post does not say that. - Guard holds curl or scp of key files. Guard holds an unexpected package install. Those holds are not in the confirmed packs. ## Pages - https://codemarine.ai/ - https://codemarine.ai/guard - https://codemarine.ai/features - https://codemarine.ai/how-it-works - https://codemarine.ai/enlist - https://codemarine.ai/core - https://codemarine.ai/about - https://codemarine.ai/privacy - https://codemarine.ai/terms ## Short answers What is Guard? A local action firewall for AI coding agents. It blocks or holds actions before they run. Is it an AI product? No. Decisions are deterministic rules. Does it keep working if the app is quit? Yes. The hooks stay up. Can I buy Watch? Not yet. Lookout is free. The invited beta is free. What is Core? The on-save scanner. Second product. Source is not uploaded to scan.