Docs

Install Usage Configuration Rule IDs FAQ

Install

Download a release binary (linux / darwin / windows, amd64 + arm64):

curl -sL https://github.com/Blackman99/failshut/releases/download/v0.1.1/failshut_0.1.1_linux_amd64.tar.gz | tar xz
./failshut version

Or with Go 1.24+:

go install github.com/Blackman99/failshut/cmd/failshut@latest

Usage

failshut                 # audit (default)
failshut audit           # same
failshut audit --json
failshut audit --project /path/to/repo
failshut audit --rule ask-vs-effective
failshut mcp             # read-only MCP stdio
failshut version

Exit 1 if any FAIL OPEN finding; 0 if all fail shut or nothing is configured.

Colors when stdout is a TTY. Disable with --no-color or NO_COLOR=1.

What gets scanned

Claude Code: ~/.claude/settings.json, settings.local.json, project .claude/settings.json — hooks, permissionMode, allow/deny/ask
Codex: ~/.codex/config.toml (+ sibling *.toml) — approval_policy, sandbox_mode, sandbox_approval, profiles, delegation
OpenCode: opencode.json / .opencode/ under --project and user config dirs — permission deny/ask, path fields
Cursor: best-effort readable CLI permission files when present

Missing files are skipped. failshut never writes to your configs.

Rule IDs

deny-ignored — OpenCode read/edit deny/ask rule that never matches: ./-prefixed resource (opencode#55728) or absolute resource inside the project (opencode#53365). A plain "read": "deny" works and is not flagged.
ask-vs-effective — heuristic Codex approval/sandbox mismatches; does not cover codex#54298 (Codex granular.sandbox_approval=false auto-rejects, i.e. fails shut)
hook-missing — hook script missing or not executable; the command is parsed like a shell (bash/python3/node prefixes, quotes, ~, $HOME, "$CLAUDE_PROJECT_DIR"), never executed (claude-code#32990, #102649)
path-traversal-config — .. segment in project/session path that can load a sibling opencode.json (opencode#55909)
delegation-escalate — OpenCode agent (incl. plan) that denies edit but does not deny the general subagent (opencode#55814)
ask-auto-allow — heuristic hook-ask + auto-allow pairing; claude-code#102582 itself is not decidable from settings yet

FAQ

Does this block tools at runtime? No. v0.1 is a static auditor. Live canaries are on the roadmap (--canary returns “not in v0.1”).

Nothing configured — is that fail-open? No. Clear message, exit 0. You still need policies for policies to hold.

MCP? failshut mcp exposes read-only tools audit_report and list_findings. It never mutates configs.

False positives? Rules mirror public issue shapes. Open an issue with a redacted fixture if a sealed config flags.