Elytra
Local guardrails for coding agents. Elytra checks what Claude Code, Codex, Grok and Antigravity try to do and holds consequential actions for a person's decision before they run.
Results
- 01Open source under Apache-2.0 and installable from PyPI as elytra-mcp, with hooks for Claude Code, Codex, Grok and Antigravity.
- 02elytra explain shows how any command would be decided, and elytra uninstall restores every agent configuration exactly.
- 03Documented limits: shell classification and content inspection are heuristics, and self-protection is best-effort.
Engineering details
Coding agents run shell commands, edit files, read the web and call MCP tools on a developer's machine. Some of those actions are consequential, and an agent that has read untrusted content can be steered toward them.
Classify every tool call
Agent hooks run one short-lived process per tool call. Shell commands, file edits and web access are classified into fixed actions such as reads, installs, pushes, sends, deletes and history rewrites.
Decide on the developer's machine
A loopback-only runtime decides each call against a guardrail preset and the developer's rules: allow, ask, hold or block. An allowed call receives a single-use permit bound to its exact arguments.
Remember what the session has read
Content from outside, such as an issue, a page or an email, marks the session as untrusted for what follows. In every preset, sending data out after untrusted reads, or sending secrets, is blocked.