Rampart: Open-Source Firewall for AI Agents

What changed

Rampart has been released as an open-source project, offering a policy and approval control system specifically for AI agents. This firewall aims to audit and manage what AI tools, including OpenClaw, Claude Code, Cursor, and Codex, can do on a user's local machine. The system operates by sitting at various integration points—such as hooks, plugins, proxies, and process boundaries—to evaluate proposed actions against predefined local policies. Based on this evaluation, Rampart returns an 'allow', 'ask', or 'deny' decision before the host system executes the action. This ensures that decisions are visible, approvals remain under human ownership, and all actions are logged in a hash-chained audit trail. Rampart is described as a security boundary rather than a sandbox, meaning it monitors actions exposed by configured integrations but does not oversee arbitrary system calls or network traffic within an already permitted process.

Installation can be done via Homebrew (brew install peg/tap/rampart), a curl script for macOS and Linux (curl -fsSL https://rampart.sh/install | bash), or PowerShell for Windows (irm https://rampart.sh/install.ps1 | iex). Go developers can install it using go install github.com/peg/rampart/cmd/rampart@latest, requiring Go 1.26.8 or newer. The installation process typically involves rampart protect to detect and configure managed boundaries for supported agents, rampart verify --all to run non-executing canaries, and rampart watch to monitor decisions in real-time.

Rampart supports a growing list of integrations, including OpenClaw, Claude Code, Codex, Cline, Antigravity, GitHub Copilot, Cursor, Hermes Agent, Gemini CLI, and MCP servers. Each integration has a defined observation boundary, and Rampart normalizes the actions visible there. Policies are defined in YAML and can be hot-reloaded. Common policy examples include blocking reads of sensitive files like SSH keys or .env files, and requiring explicit approval for execution commands such as kubectl apply or terraform apply. For common use cases, users can also define policies via CLI commands like rampart allow "npm install *" or rampart block "curl * | bash".

Why it matters for builders

For developers building and integrating AI agents, Rampart provides a much-needed mechanism for security and governance. It allows builders to define explicit rules about what their AI tools can and cannot do, preventing unintended consequences or security breaches. The audit trail feature is particularly valuable for debugging and understanding agent behavior in production environments. By offering a local, model-free policy engine by default, Rampart ensures that core enforcement doesn't rely on external services, enhancing privacy and reliability.

Practical impact

AI builders should explore integrating Rampart into their development workflows to gain better control over AI agent actions. Testing Rampart with existing AI tools like Cursor or Claude Code can reveal potential risks and allow for proactive policy creation. The ability to define granular policies, such as restricting file access or requiring approval for specific commands, can be implemented using the provided YAML configuration or CLI commands. Developers can also leverage the rampart watch command to monitor agent activities in real-time and the rampart audit tail command for post-execution analysis. For those working with agents that lack native hooks, Rampart offers experimental wrapping and preloading capabilities.

Caveats and source limits

The source material indicates that Rampart is a "fresh release" and provides GitHub star and fork counts (78 stars, 12 forks) as of its latest update. While it lists numerous integrations, some are marked as experimental, and their assurance levels vary. For instance, GitHub Copilot integration is pending authenticated ingestion, and Gemini CLI requires authenticated host proof. The security assurance model and specific platform coverage for each integration are detailed in a support matrix, which is not fully elaborated in the provided excerpt. Rampart is positioned as a security boundary, not a sandbox, and its effectiveness depends on the visibility of actions exposed by the configured integration. The source does not provide details on performance benchmarks or specific pricing, as it is an open-source project.