AI coding agent guardrails

Agents write the code. Your rules still hold.

The ops0 CLI checks every Terraform change a coding agent writes against your policies and budget before its turn ends, and stops destroy commands before they run.

Checks every turn
Destroy blocked
Policies over MCP
Every attempt logged

ops0 brings your clouds, runtime, infrastructure code, and workflows into one operating context. For AI coding agents that write Terraform, OpenTofu, or Oxid, the ops0 CLI runs validation, lint, policy and security checks, a cost estimate, and a budget check at the end of every agent turn, returns failures to the agent so it fixes them, blocks terraform destroy before it runs, and records every failed check and blocked command.

The CLI on GitHub
~/infra/payments · agent session
$ ops0 validate .
ops0 validate . (4 files, 8.2s)
✓ Configuration is valid
tflint: 0 error(s), 2 warning(s), 0 notice(s)
scan: 14 passed, 1 failed. Severity: 1C / 0H / 0M / 0L
  [CRITICAL] no-public-s3: S3 bucket has public read access
cost: $284.50 / month across 6 resource(s)
budget: ✓ $284.50/mo within project limit of $500.00/mo.
 
$ terraform destroy -auto-approve
ops0 governance: this command would destroy infrastructure.
  Blocked by: organization policy (no unrestricted destroy)
  Override:   prefix with  OPS0_ALLOW_DESTROY=1  and rerun.

Review used to happen on the pull request. Now it has to happen before the agent stops typing. 

5 checks every turnterraform, tofu, oxid destroy blocked4 MCP toolsFree plan includes the CLI
A coding agent, checked
01 / 04 · Write

The agent writes the change.

It edits the Terraform and ends its turn. Nobody has to remember to ask for a scan.

Coding agentwritingValidateidleLintidlePolicy + securityidleCostidleBudgetidlePre-command hookidleterraform destroyidleActivity logidle
Going deeper

Rules before, checks during, a record after.

Before the first line

The agent starts with your rules.

ops0 init writes your required tags and doc structure into the agent’s instructions.
Over MCP, the agent can list policies and pull your IaC standards before it writes a module.
IaC standards served to the agentMCP
Required tags
EnvironmentProjectOwnerManagedByManagedIaCCostCenter
Docs
README.md + docs/
Diagrams
Mermaid rules
Scope
Org or project
Updates
Server-side
Under the hood

Small tool, strict gate.

Install
One command, then one key.
curl -fsSL https://raw.githubusercontent.com/ops0-ai/ops0-cli/main/install.sh | sh
ops0 login --api-base https://brew.ops0.ai
ops0 init
macOS and Linux · Windows release zip
Override
Teardown only when a person allows it.
export OPS0_ALLOW_DESTROY=1
set before the session starts. The hook reads its own environment, so a prefix the agent types is still blocked.
Any MCP agent
Four tools over MCP.
list_policies
check_compliance
get_finding_details
get_iac_standards
Monorepos
Each folder, its own rules.
customer/alpha → project alpha
customer/beta → project beta
nearest .ops0/config.json, 12 levels deep
Report
A file the agent reads.
ops0-scan.md
rewritten every run: validate, lint, findings, cost, budget
Your code
Checked over HTTPS, not stored.

Files go to ops0 over HTTPS for validation and are not kept. Credentials sit in your user config with owner-only permissions. Org-wide rules apply by default; bind a folder to a project when you want that project's policies and budget too.

Common questions

Put the block in a hook the agent cannot talk its way past, not in a prompt. ops0 init installs a pre-command hook that stops terraform destroy, tofu destroy, oxid destroy, and plan -destroy before they execute and records each attempt. To tear down a sandbox on purpose, a person sets OPS0_ALLOW_DESTROY=1 in the environment before starting the session. The hook checks its own environment, not the command text, so an agent that adds the variable to its command is still blocked.
RelatedGoverned DeploymentsIaCStopping terraform destroy

Let agents write fast.
Ship only what passes.

Install the CLI in a minute. Every change an agent writes is checked against the rules your platform team already runs, and production stays behind a reviewed plan and an approval.

Explore Deployments