Your coding agent deletes files without asking, walks past your uncommitted work, and never tells you to rotate the key you pasted.
Guardrail Supply: guardrails for your AI coding agent. A handful of tested rules files that stopped it doing those three things in our tests. 3/3 runs with the pack, 0/3 without.
Get the pack — $9Agent Guardrails + Next.js 15, v0.2. Plain text files. Drop into your repo.
The problem
AI coding agents are fast and casually destructive. People report agents running rm after a delete was rejected, and rewriting files over work that was never committed. Rules files are the cheap first line of defense. Most published ones are untested.
Measured before / after
3 runs per arm. Same repo, same prompts. Rules committed in the repo; the agent was not told to read them.
| Behavior | Without pack | With pack |
|---|---|---|
| Asks before deleting files | 0/3 | 3/3 |
| Checks for and flags uncommitted changes before editing | 0/3 | 3/3 |
| Refuses to store pasted secrets, tells you to rotate them | 0/3 | 3/3 |
Awaits async params (Next.js 15) | 3/3 | 3/3 — no difference |
Three runs is a small sample. These are results from our test, not guarantees.
What's in the pack
scope-and-safety.mdc: no deletes or destructive git commands without asking; stay inside the request.git-checkpoint.mdc: checkgit statusfirst, flag work you haven't committed, targeted edits instead of whole-file rewrites.secrets-env.mdc: no secrets in source orNEXT_PUBLIC_*; pasted secrets get a "rotate this" warning.tests-are-sacred.mdc: don't delete, skip, or weaken tests to get green.nextjs-app-router.mdc,nextjs-async-request-apis.mdc,server-client-boundary.mdc: Next.js 15 App Router conventions, checked against the nextjs.org docs.AGENTS.mdandCLAUDE.md: the same rules in one short file each.- README with install steps and what each rule is for.
Honest limits
- Three of the rules have a measured win. The async-params rule showed no difference because the agent already got it right. The other Next.js and tests rules are included but not yet measured.
- We can't prove any tool auto-loads these files in every setup. Drop them into your repo; that's the claim.
- Rules are guidance, not enforcement. Keep backups, use git, and keep command approval on.
- 3 runs per arm. Small sample, one setup.
FAQ
Which tools does it work with?
It ships Cursor .mdc rules, AGENTS.md, and CLAUDE.md. Our measurements used one agent setup; results in other tools are untested.
Do I need Next.js?
The three measured guardrails are stack-agnostic. The Next.js rules only matter for Next.js 15 App Router projects.
Can't I write these myself?
Yes. You're paying for the testing and the wording that held up in it.
Refunds?
[Refund policy TBD]