Your AI coding agent will commit your .env unless you stop it — I built the gate

#ai #mcp #claude #llm

Every AI coding agent I've used — Claude Code, Cursor, Copilot, Windsurf, Devin — will eventually try something you don't want. Commit a .env. Run rm -rf. Hallucinate a deprecated API. Burn your API budget in a loop.

The guardrails I've seen are suggestions in a system prompt. "Please don't do that." Models are really good at ignoring suggestions.

So I built aiZee: a local control plane that sits between you and the agent and enforces policy on the actual action path. Not advice — a wall.

The demo

aizee check 'Bash' --args '{"command":"git add .env && git commit -m keys"}' returns:

{
  "ok": false,
  "decision": "deny",
  "reason": "guardian: commits secrets file .env"
}

That denial is not a warning the model can talk itself out of. It happens before the tool executes.

How it works

Every tool call, LLM request, memory write, and file change flows through one kernel pipeline:

Probity → Guardian → Policy → LoopDetector → Budget → Audit

Probity — integrity verification of the runtime itself
Guardian — pre-action checks (secret commits, destructive commands)
Policy — YAML rules with allow / ask / deny / modify / observe verdicts. modify rewrites a payload (audited), observe logs without blocking — verdicts beyond the usual allow/deny/ask
LoopDetector — blocks repeated tool-call loops before they burn budget
Budget — token/cost/call limits per session, hour, day, week, month — and per PR in CI
Audit — append-only, SHA-256 hash-chained, Ed25519-signed trail

On top of that: prompt-injection detection on inbound content (regex + embeddings + optional LLM judge), secret-leak checks on outbound responses, and an MCP firewall + gateway wrapping every external tool call.

It's not just a gate — it's an agent OS

The governance layer sits on top of a full environment:

245 skills with hash-locked integrity (skills-lock.json detects any tampering)
29 auto-detected personas — keyword scoring in English and Arabic, multi-persona composition, lifecycle-aware routing that reads your active BMAD initiative and biases selection to the current phase
BMAD-METHOD vendored — the full agile-ai lifecycle (analyst → PM → architect → dev → PO) with ticket trees
Hybrid memory — SQLite + FTS5 + optional vectors, bi-temporal queries, HMAC integrity
MCP server — 46 tools, plus a governed LLM proxy with failover
Dashboard — dark-first command center (Python stdlib, no Node required)

The numbers

7,656 tests, strict mypy on 223 source files, ruff clean
99.5% coverage on the governed surface
1,244 files integrity-validated, 0 errors
MIT licensed

Try it

pip install aizee
aizee bootstrap --target ~/.aizee   # materializes the full OS root from the wheel
aizee doctor                        # 46-check health verdict

The bootstrap extracts 1,900 files — skills, workflows, tech-stack references, policies, scripts — so pip install alone gives you a full-capability install, not a hollow shell. External tools (CLI utilities, media kits, docker images) are declared in deps.yaml and provisioned with aizee deps check|install.

Why I built it

AI agents are becoming the primary way code gets written. They are also the least governed layer in the stack — no audit trail, no budget enforcement, no policy engine. Prompt-level guardrails don't survive contact with a determined (or just confused) model.

aiZee treats agent actions like production infrastructure: every action passes a gate, every gate decision is logged, every log entry is signed.

Repo: https://github.com/m3taz-ahmed/aizee — demo GIF in the README shows the guardian denying a secret commit mid-flight.

I'd love feedback on the policy model — especially the modify/observe verdicts, which go beyond allow/deny/ask. What verdict types do you think we're missing?

DEV Community