What is fence?

Fence is a safety layer for AI coding agents like Claude Code, Codex, and OpenCode. When one of these agents tries to run a command in your terminal, Fence checks it first and can block the command entirely, ask you to confirm it, or let it through silently, before the agent's action ever actually runs. The problem it addresses is that coding agents run with your own permissions on your machine, so a confused agent, or one tricked by a hidden instruction buried in a file it read, could delete your files, leak your credentials, or set up unwanted persistence with nothing stopping it. Simple keyword-blocking tools are easy to trick by rephrasing a command, and they tend to be so noisy that people turn them off. Fence instead looks at what a command actually does rather than matching text patterns, so it catches many different ways of writing the same dangerous command, such as wiping a home directory, while staying quiet on everyday commands like deleting a node_modules folder or force-pushing with a safety flag. Built-in protection covers things like wiping your home or root directory, wiping an entire disk, running a fork bomb, sending private keys or credentials out over the network, opening up file permissions system-wide, rewriting git history, and installing packages from untrusted sources. Some of these are blocked outright, while riskier but sometimes legitimate actions, like a forced git push, prompt you to confirm before continuing. Fence installs through Homebrew or npm, and for Claude Code a single command wires it into that tool's hook system for every project, showing a small status line confirming it is active. Similar one-line setup exists for Codex and OpenCode. You can also write your own custom rules in a YAML file, override how strict a built-in rule is, or install rule packs shared by others for tools like Terraform or Kubernetes. The project notes it fails open: if it cannot understand a command, that command is simply allowed to run rather than getting stuck, since a safety tool should never break the agent it is meant to protect. Windows is not yet natively supported, though it works normally inside WSL. The project is released under the MIT license.