Decide whether an agent-authored bash command complies with an execution policy,
Decide whether an agent-authored bash command complies with an execution policy, using a real shell tokenizer rather than pattern matching. Catches recursive deletes, force pushes, cluster and infrastructure teardown, raw device writes, path escapes, privilege escalation, and curl-piped-to-shell through pipelines, substitutions, quoting games and base64. Returns reason codes with spans and an optional short-lived permit bound to the exact canonical command. Never executes anything.
Not tested: has real-world effectsour last check, 2026-09-24
0 of 0checks answered this week
n/amedian answer time
$0.015listed price per call
n/aprice it asked us
Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.
Endpoint
POST https://shellpermit.schemasure.com/v1/guard/shell
| Category | Code and developer |
|---|---|
| Provider host | shellpermit.schemasure.com |
| Networks | eip155:8453 |
| Payment schemes | exact |
| Self-reported calls, 30 days | 9 from 1 payers (the provider's figure, not ours) |
Our checks, last 30 days
We never call tools that send, buy, move money or file anything, not even without paying.
Example input (from the provider)
{
"body": {
"audience": "executor:acme-prod-01",
"command": "rm -rf ./dist && npm run build",
"issue_permit": true,
"policy": {
"allow_destructive": true,
"allow_network_egress": false,
"allowed_roots": [
"/srv/app"
],
"cwd": "/srv/app"
},
"shell": "bash"
},
"bodyType": "json",
"method": "POST",
"type": "http"
}
Promised output schema (from the provider)
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"audience": {
"description": "Identity of the ONE executor the permit is for. Required when issue_permit is true. Wildcards are rejected.",
"type": "string"
},
"command": {
"maxLength": 32768,
"minLength": 1,
"type": "string"
},
"env": {
"additionalProperties": {
"type": "string"
},
"description": "Environment the executor will run with, used only for static expansion so that paths like \"$HOME/.cache\" can be resolved and decided rather than reported as unresolvable.",
"type": "object"
},
"issue_permit": {
"type": "boolean"
},
"policy": {
"additionalProperties": false,
"properties": {
"allow_destructive": {
"description": "Permit deletes, truncations, and overwrites. Defaults to false.",
"type": "boolean"
},
"allow_network_egress": {
"description": "Permit commands that reach the network. Defaults to false.",
"type": "boolean"
},
"allow_privilege_escalation": {
"description": "Permit sudo, su, chmod 777, chown root. Defaults to false.",
"type": "boolean"
},
"allowed_commands": {
"description": "If set, argv[0] must appear here.",
"items": {
"type": "string"
},
"type": "array"
},
"allowed_roots": {
"description": "Absolute directories the command may touch. Containment is lexical, not symlink-resolved.",
"items": {
"type": "string"
},
"type": "array"
},
"cwd": {
"description": "Absolute working directory relative operands resolve against. Defaults to the first allowed root.",
"type": "string"
},
"denied_commands": {
"description": "Always blocked, applied after allowed_commands.",
"items": {
"type": "string"
},
"type": "array"
},
"max_segments": {
"description": "Ceiling on chained segments. Defaults to 32.",
"minimum": 1,
"type": "integer"
},
"protected_branches": {
"description": "Branches a force push must never target. Defaults to main, master, trunk, develop, production, prod, release.",
"items": {
"type": "string"
},
"type": "array"
},
"timeout_ms": {
"description": "Execution timeout written into the permit obligations. Defaults to 120000.",
"minimum": 1,
"type": "integer"
}
},
"type": "object"
},
"shell": {
"description": "Required. Only bash is supported in v1: a permit issued under one shell's grammar and executed under another is a parser differential with a signature on it.",
"enum": [
"bash"
],
"type": "string"
},
"subject": {
"description": "Opaque caller label recorded as the permit subject.",
"type": "string"
}
},
"required": [
"shell",
"command"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"confidence": {
"type": "number"
},
"evidence": {
"items": {
"properties": {
"code": {
"description": "Stable reason code, e.g. REMOTE_CODE_EXECUTION.",
"type": "string"
},
"data": {
"type": "object"
},
"detail": {
"type": "string"
},
"disposition": {
"description": "What this finding does to the verdict, which is a different axis from how bad it is.",
"enum": [
"block",
"unknown",
"warn",
"info"
],
"type": "string"
},
"severity": {
"enum": [
"info",
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"source": {
"type": "string"