AgentToolDrop

27 of 43

CC Safety Net

Blocks destructive git and file commands and reads of secret files before a coding agent's tool call runs

Install into your coding CLIs with npx

npx -y cc-safety-net@latest install
npx -y cc-safety-net@latest doctor

Copied from the project's docs at github.com/kenryu42/cc-safety-net

Why you'd want it

CC Safety Net installs as a pre-execution hook in coding CLIs including Claude Code, Codex, Cursor, Gemini CLI, OpenCode and Copilot CLI, and parses what each command does, so wrapping it in bash -c or python -c or reordering flags does not hide it. It blocks commands such as git reset --hard, git push --force and rm -rf on dangerous targets, and access to SSH keys, .env files, ~/.aws and coding CLI credentials. Presets are tuned in a local GUI, official rulebooks add blocks for Terraform, AWS, gcloud and Azure, and committing .cc-safety-net/ shares the policy through git.

Best for

  • Stopping agent force pushes and hard resets
  • Keeping agents away from .env files and SSH keys
  • Teams running several coding CLIs

Use it when

You let a coding agent run shell commands and want a check that refuses destructive git and file operations before they execute.

Skip it if

You need containment: the README says it is not a sandbox and does not contain processes, set filesystem permissions or watch network egress. It is maintained mostly by one developer and needs Node.js 18 or higher.

Editor's note

The README says a broken config file never blocks anything, so a typo fails open rather than stopping the agent.

Related tools

Same category or shared tags.

  1. Spec Kit

    Devtool Standard

    Gives coding agents structured processes for spec-driven builds, bug fixes and idea assessment

    • 141k stars
    • 337 stars/day since creation
    • pushed
    • v1.2.0 on
    • MIT

    Install with uv and create a project

    uv tool install specify-cli
specify init my-project --integration copilot
    Use it when, skip it if, stats for Spec Kit

    Why you'd want it

    The specify CLI installs skills or command files for your coding agent, which you then run in chat: constitution once per project, then specify, plan, tasks, implement and converge for each feature. Optional extensions add a bug-fixing flow (assess, fix, test) and an idea assessment flow that ends in a go, clarify or stop decision, with reports saved as Markdown under .specify/. It has integrations for dozens of agents, including GitHub Copilot, Claude Code, Codex CLI, Cursor, Gemini CLI and Zed, and you can customize it with extensions, presets and workflows.

    Best for

    • Teams that want a spec before code
    • Keeping agent work reviewable step by step
    • Using one process across several coding agents

    Use it when

    You want a coding agent to work from a written specification, plan and task list rather than one prompt, with artifacts you review at each step.

    Skip it if

    Your changes are small enough that a single prompt does the job. The CLI needs Python 3.11+ and uv.

    Stats

    Stars
    141,318
    Last push
    Release
    v1.2.0,
    License
    MIT
    Pricing
    Open source
    Works with
    Claude Code, Cursor, Codex, Gemini CLI, Zed, Linux, macOS, Windows
    Stars per day, since repo creation
    337
    Tier
    Standard, not ranked

    Full stat block for Spec Kit

  2. Rank 6

    Orca

    Devtool

    Runs several CLI coding agents side by side, each in its own git worktree, in one desktop app

    • score 61
    • 92.7k stars
    • 437 stars/day since creation
    • pushed
    • v1.4.226 on
    • MIT

    Download the app, or install with Homebrew on macOS

    brew install --cask stablyai/orca/orca
    Use it when, skip it if, stats for Orca

    Why you'd want it

    Orca is a desktop app for running Claude Code, Codex, OpenCode, Pi and other terminal agents in parallel, each in an isolated git worktree, so you can fan one prompt across several agents, compare the results and merge the one you want. It combines terminal splits, VS Code's editor, an embedded Chromium with a Design Mode that sends an element's HTML, CSS and a screenshot into a prompt, GitHub and Linear task views, SSH worktrees on remote machines and inline comments on AI diffs. A CLI lets agents drive Orca themselves, and iOS and Android companion apps notify you when an agent finishes and let you send follow-ups.

    Best for

    • Comparing several agents on one task
    • Managing many worktrees in one place
    • Steering agents from a phone

    Use it when

    You run several CLI coding agents at once and want one window for their worktrees, terminals, diffs and reviews instead of juggling terminal tabs.

    Skip it if

    You prefer a terminal-only setup or use one agent at a time. It collects anonymous usage data unless you opt out, its Computer Use feature lets agents operate desktop apps, and it ships releases almost daily with a large open issue and pull request backlog.

    Stats

    Stars
    92,678
    Last push
    Release
    v1.4.226,
    License
    MIT
    Pricing
    Open source
    Works with
    Claude Code, Codex, Cursor, macOS, Windows, Linux
    Stars per day, since repo creation
    437
    New and rising score
    61 of 100

    Full stat block for Orca

  3. Rank 7

    herdr

    Devtool

    Keeps coding agent terminals running in a background server and marks each pane as working, blocked or idle

    • score 59
    • 44.1k stars
    • 219 stars/day since creation
    • pushed
    • v0.9.5 on
    • Apache-2.0

    Install with Homebrew

    brew install herdr
    Use it when, skip it if, stats for herdr

    Why you'd want it

    herdr is a terminal workspace for coding agents, a single Rust binary that runs inside the terminal you already use. Terminals keep running in a background server when you close the client or lose an SSH connection, and after a restart it restores the saved layout and can resume supported agent sessions. Every pane is marked working, blocked or idle, local and saved SSH machines share one window, and agents can drive herdr through its CLI and socket API to spawn panes, prompt each other and wait until another agent is blocked. It runs Claude Code, Codex, Cursor, OpenCode and other agents without wrapping them, with tmux-style prefix keys and mouse control.

    Best for

    • Running many terminal agents side by side
    • Detaching from long agent runs
    • Agents on remote machines over SSH

    Use it when

    You run several CLI coding agents at once, often over SSH, and want to detach, come back and see which one needs an answer.

    Skip it if

    You already have a tmux setup you like and run one agent at a time. Agents can use herdr's socket API to spawn panes and prompt other agents, and after a server or machine restart the original processes are gone, only the layout and supported sessions come back.

    Stats

    Stars
    44,074
    Last push
    Release
    v0.9.5,
    License
    Apache-2.0
    Pricing
    Open source
    Works with
    Claude Code, Codex, Cursor, macOS, Linux, Windows
    Stars per day, since repo creation
    219
    New and rising score
    59 of 100

    Full stat block for herdr

For agents

The same entry, as files an agent can read without scraping this page. 

# read one entry
curl -s https://agenttooldrop.com/tools/cc-safety-net.md

# list the MCP servers in the catalog
curl -s https://agenttooldrop.com/tools.json \
  | jq -r '.tools[] | select(.category=="mcp-server") | .slug'