rv

Authorize agent actions before they run

rv is a hook-grade shell guard for coding agents. It sits on the host hook wire — not in the prompt, not after the fact — and decides allow or deny before a shell command runs.

Agents generate actions. rv authorizes them before they run.

v0.1 ships for Grok, Pi, OpenCode, Claude, OpenClaw, Hermes, Codex, and Cursor on macOS 26, Apple Silicon. One command: rv.

What it does

  • Evaluates destructive git and filesystem commands against local packs
  • Denies malformed hook JSON
  • Honors a one-shot grant (rv allow-once) when the adapter sends cwd
  • Denies known secret paths such as .env and SSH keys
  • Wires host adapters with rv setup

Install

curl -fsSL https://rykanv.com/install | sh

rv setup

rv doctor

rv test "git reset --hard"

rv test "rm -rf /"
rv explain "rm -rf /"

Then run rv test 'git reset --hard' after setup.

Next