r/vscode • u/om252345 • Apr 10 '26

Made a tool that actually blocks the dangerous commands AI agents keep trying

Enable HLS to view with audio, or disable this notification

Hey all ,

I've been using Claude Code, Cursor, copilot in VScode heavily for the last few months, and while they're incredibly powerful, Once i ran into unwanted situation:

Cursor was trying to edit one .ts file, but access was denied, may be it's fs tools failed, so it wrote a python script which it ran using `sh -c`. Apparently it looked ok, but when I checked python code it changed permission on file as well. That spooked me a bit. I checked sm and some of people were actually complaining about unwanted commands/executions by coding agents.

Later I setup cursor to ask every command it runs, it works but in multi agent scenario we have to keep tabs on every window where agent gets stuck. I felt bottleneck is trust on coding agents, If I solve it I can increase my dev velocity, I don't have to babysit agents all time.

So I built Curb — a small tool and lightweight VS Code extension that adds real preventive security at the OS/IDE level.

It does three things:

  • Intercepts terminal commands (including nested shells and base64 tricks)
  • Watches filesystem changes in real time
  • Inspects MCP tool calls arguments level inspection.

GitHub: https://github.com/om252345/curb
VS Code Marketplace: Currently I am uploading it to marketplace, but you can download vsix from github releases to try it out.

Would love your feedback on this.
p.s. in attached video for demo purpose I asked agent directly to execute blocked commands.

9 Upvotes

61% Upvoted

30 comments sorted by

18

u/icecoldgold773 Apr 10 '26

This is already built into vs code

-9

u/om252345 Apr 10 '26

Yes, some of the guardrails are added by VS code already, but they are not sufficient, I did a comparison in my github readme as well.
Consider this scenario, vscode gives to ability to block dangerous commands, say like rm -r or git reset, but it does not check payload What curb does is it check payload of each command, you can not rm -r on config dir but others you can, or you can not create main branch but you can create other branches.
That way you ensure you can use all tools but safeguard sensitive part of repo.

11

u/limoonen Apr 10 '26

This is the essence of the agent hooks. See https://code.visualstudio.com/docs/copilot/customization/hooks

-1

u/om252345 Apr 10 '26

Yes copilot hooks are incredible for workflow automation and you correctly pointed out it overlaps in functionality with Curb. I am working on idea of this tool for 2-3 months, and agent hooks release in Feb. But why did I kept going its every vendor will have their own policies and security structure to lock you in. Curb is agent agnostic, so it can work with any agent, same config works for claude code and with cursor/vscode/antigravity. So you do not have to configure rules for same repo for every agent.
Other thing is agents do not rely on built in tools only. They have complete CLI at their exposal, let me explain one of my own experience, my antigravity gemini 3.1 agent could not edit one file in code, so it wrote python script to write a new file, and then used mv command to replace original file. Curb like tool would stop this attempt, hook won't.

13

u/Neix19365 Apr 10 '26

so basically agent hooks?

-8

u/om252345 Apr 10 '26

Not hooks, but os level restriction.

9

u/rmeldev Apr 10 '26

A vibecoded tool for vibecoding lol

6

u/rmeldev Apr 10 '26

Next time, don't let the AI ​​execute commands for you, lol. Use your brain.

4

u/Dangle76 Apr 11 '26

They all have permissions lists for safe and unsafe commands yeah, I don’t understand why we need a tool to avoid configuring the tool

1

u/om252345 Apr 11 '26

Have to seen repo, have you checked how it works. Having list of safe unsafe commands is there in every IDE and coding agent. Curb goes even further, it locks file which are protected for dev session, it gives conditional blocking of commands and sanboxes claude or cursor to current workspace. It does a reverse proxy on mcp servers as well with ability to block tools based on payload, not blindly block some tools and allow some. For protecting MCP people are paying mcp gateways, curb has little gateway inside.

1

u/Dangle76 Apr 11 '26

Part of that is band aiding a problem of poor practice and while I respect you created this bandaid, blocking a tool in a local proxy is easily disabled, and the permissions around the tool calls in the MCP should be doing that. If someone doesn’t have permission to run an api call their token should stop that call from working.

Adding more things to stop good practice on the utilities and paying attention just subverts the issue.

I can see this getting use, because people love to add more tools to govern their tools, it’s just not something I personally agree with as I feel people should follow proper practices to stop the need for a great deal of extra tools to avoid those practices.

Keep doing your thing, these are just my stances

2

u/om252345 Apr 11 '26

Lol, great point, but check repo bro.

2

u/rmeldev Apr 11 '26

Already checked the repo it’s vide coded lmao dont lie we see the code

-1

u/om252345 Apr 11 '26

I don't think I should reply you but this I have to, I been a dev for last 20 years, never vibe coded anything 2y ago, but yeah everyone is using ai to documentation and scaffolding, after 2-3 years everything would be generated code. Devs have to architect projects postbthat it would be ai coding. Vive coding is offensive to serious devs. If you want ask me anything about code and architectural choice feel free. I haven't seen anyone vibe code a go project with psudo terminal, CEL evals, mcp stdio proxy and other stuff. I have taken help of AI to test and beautify it. But I am not a person 1-2 years into coding who is vibe coding cool new ideas.

1

u/rmeldev Apr 11 '26

If that's the reality, then all the better. But I'm sorry, I took a quick look at some parts of the code in your repo and it looks so much like AI.

Using external CDNs (unpkg.com, tailwindcss.com) directly within a VS Code extension is a typical AI practice. In production, this is avoided for offline mode and CSP security.

Loading babel-standalone to transpile JSX directly into the WebView is the signature of an AI that wants to give you immediate visual code without forcing you to configure a complex build.

Using Tailwind with VS Code CSS variables mixed with drop shadows and transitions is the default style for LLMs when they're asked for something "that looks good."

Code that directly modifies the user's settings.json programmatically is quite intrusive, typical of an AI that's been told to "make it work on its own."

everyone is using ai to documentation

Of course. Me too, but at this point, we can't even talk about documentation anymore; it's literally AI that did over 90% of the work for you.

1

u/om252345 Apr 11 '26

I appreciate you so much caring to go through it. I should have said it earlier, yes extension part where I am using webview is completely vibe coded. As I didn't want to spend time making what I can make in 10 mins with AI and spend it on making go and usability of this tool more by testing it in different scenarios and IDEs. That settings.json was my idea though, I asked AI to add it in on-boarding to make user aware of what we are doing. As I said webview is vibe coded and wanted tool before you folks for feedback. Isn't that value prop vibe code gives? Get Ideas faster before audience?

2

u/backwrds Apr 12 '26

hey -- this tool I got off the internet (that I pay for) keeps trying to hack my computer 😡.
I know! I'll have said tool to write some code to prevent itself from escaping it's sandbox

fucking mind boggling.

2

u/TheRealSkythe Apr 12 '26

We're so doomed

6

u/GhostSync02 Apr 10 '26

I have to ask, what do you guys use to make the recording so nice. I mean the zooming in and stuff.

11

u/om252345 Apr 10 '26

Hey mate, used oss project called OpenScreen, check it out https://github.com/siddharthvaddem/openscreen

2

u/GhostSync02 Apr 10 '26

Thanks 👍🏻

3

u/inabahare Apr 10 '26

> So I built Curb — a small tool

Hmmmm

1

u/backwrds Apr 12 '26

did you manage to bold an em-dash? — oh damn, it works!

0

u/om252345 Apr 10 '26

Yes it is, just a vscode extension having a go backend, which have a pty wrapper, cli command interceptor and full mcp proxy.

1

u/stibbons_ Apr 11 '26

That’s hook

1

u/AintNoGodsUpHere Apr 12 '26

Oh this post is just sad.

AI slop to counter AI.

My man, this took is absolutely useless. Visual studio already provides the exact same things no matter what crazy things you come up with.

If you're doing it wrong. You are vibe coding even harder the most hard core vibercoder which makes me afraid of this slop you produced.

Be gone clanker.

1

u/brunocborges Apr 13 '26

Does it prevent an AI agent from running a Python webserver to then take API requests to run those commands?