Gumpbox 1.12.3: Introducing Terminal Guardrails

Gumpbox 1.12.3 introduces Terminal Guardrails — built-in libraries of Linux commands that put a consent gate between your AI agents and your servers. When an agent runs a command through Terminal Use that matches a library you've enabled, Gumpbox pauses the request and asks you first. This post covers why agents need guardrails, how the flow works, and how to tune it per server.

Why agents need guardrails

An AI agent with server access is different from a person at the keyboard. It works fast, it runs unattended, and it doesn't pause to wonder whether reinstalling nginx was really the plan. Every serious AI SSH setup already hard-blocks the obvious no's — rm -rf /, formatting disks, killing the network stack. Gumpbox has done that from day one.

But the harder question was never the obvious no. It's the judgment calls: is this agent allowed to install packages today? Restart services? Change file ownership on production? The answer differs by server, by team, and by mood. A fixed policy can't capture it — and "trust me" isn't a policy either.

Guardrails turn that judgment into a visible gate. You decide which families of commands need a human sign-off. Agents get everything else without friction.

How guardrails work

Guardrails ship with eight curated libraries — Destructive Commands, Privilege Escalation, Package Management, Service Control, Network Configuration, Users & Permissions, Process Control, and Containers & VMs — roughly 80 commands a practitioner would recognize on sight. Enable the families you care about; add your own commands on top (exact or prefix match) for tools like terraform or nginx.

Matching is built for how agents actually write commands:

• Chains are checked segment by segment. cd /var/www && rm -rf ./build gates on the rm -rf, even though cd runs free.
• Wrappers don't hide the payload. sudo rm -rf, bash -lc 'apt install …', and su -c 'shutdown now' all resolve to the real command underneath.
• Flag-gated entries stay quiet until it matters. rm file.txt runs without ceremony; rm -rf asks. dd only gates when it's writing somewhere (of=).

When a command matches, the agent's request pauses and Gumpbox shows a consent sheet: the exact command, which library and entry matched, which client is asking, and on which server. Approve and it runs, sandboxed as always. Deny and the agent receives a clean user-cancelled result — nothing touches the terminal. Walk away and the request expires after 30 seconds without executing.

The hard safety blocks sit underneath all of this and never moved. Guardrails are the layer between "technically allowed" and "you said so."

Tune it per server

Servers differ. A scratch box can run loose while production stays tight — so every server can either follow the global library selection or carry its own, with its own master switch, straight from the Guardrails screen.

Agents aren't locked out of the picture either: a read-only guardrails resource over MCP lets a well-behaved client fetch the active configuration and the full list of gated commands before it starts work. The integration guide now tells agents plainly: if a command is denied, don't retry it — ask.

Availability

Terminal Guardrails ship free in Gumpbox 1.12.3 on every tier, on Mac. Configure them in Settings → Global MCP → Guardrails.

Download Gumpbox on the App Store