An AI assistant that works on your files safely, with approval

You can let an AI assistant work on your own files safely if you control three things: where it starts, what it may do without asking, and how you undo a change. The Safeguard CLI reads files, edits code and runs commands on your machine, and tools that change things ask first, according to the approval mode you choose.

You also do not have to give up the assistant you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. If you prefer to stay in the chat app you use today, connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from there.

This guide covers how approvals work in the common tools, a setup you can copy, worked examples with real prompts, and the mistakes that cause most bad days.

What safe looks like when an assistant can touch your files

A chat window that only answers questions cannot break anything. An assistant with tools can. Once it can act on your machine, every request falls into one of three buckets:

• Reads. Listing a folder, opening a file, searching for a string. Low risk, though it can still read things you did not mean to share, such as an .env file.
• Writes and edits. Creating a file, changing code, rewriting a config. Medium risk, because a wrong edit can be subtle.
• Commands. Running tests, installing a package, deleting or moving files. Highest risk, because a command can do anything your user account can do.

Every safe setup puts a control on each bucket. In practice there are five controls worth having.

1. Scope. Start the assistant in the folder you want it to work in, not your home directory. Most tools treat the starting folder as the project. The Safeguard CLI's @ file picker and /resume both work from the folder you started in, and OpenCode asks by default before it touches paths outside the project.

2. Approvals. Decide which actions run without a prompt. Each tool below has a setting for this, and the names differ. The Safeguard CLI calls them Ask, Auto and Yolo. Claude Code calls them permission modes. Codex pairs a sandbox mode with an approval policy. OpenCode uses allow, ask and deny rules per tool.

3. Undo. Have a way back before you start. Version control is the reliable one. Some tools add their own undo, and the details matter. Claude Code's checkpointing docs say plainly that files changed by Bash commands such as rm or mv are not tracked, and that checkpoints are "not a replacement for version control". Aider commits each change to git so you can /undo it.

4. Isolation. For anything unattended, run in a container, a virtual machine or a sandbox. Claude Code's docs reserve their skip all checks mode for "isolated containers and VMs only". Codex's workspace-write sandbox limits edits to the workspace.

5. Verification. Check the result, not just the action. Run the tests. Read the diff. If the change touched dependencies, scan again, because a fix can pull in a new version with its own problems.

It is the discipline you would apply to a new teammate with shell access. An assistant just works faster, so set the controls before the first prompt.

How common assistants handle approvals

The table compares tools that work on local files, using facts from each project's own docs and repository pages. It is not a ranking. Each tool makes different tradeoffs, and the right one depends on how you work.

Claude Code is Anthropic's agentic coding tool. It reads your codebase, edits files and runs commands, and it is available in the terminal, IDE extensions, a desktop app and the browser. Most surfaces need a Claude subscription or an Anthropic Console account. Know before adopting: in auto mode a second model, which the docs call the classifier, reviews actions instead of you, and you can cycle modes at any time with Shift+Tab.

Codex CLI is OpenAI's terminal coding agent. It inspects code, makes changes and runs commands, and its repository is Apache-2.0. The README recommends signing in with ChatGPT on a Plus, Pro, Business, Edu or Enterprise plan, and an API key also works. Know before adopting: workspace-write is the default low-friction sandbox mode for local work, so edits stay inside the workspace unless you change it.

OpenCode describes itself as "the open source AI coding agent" and is MIT licensed. It is mainly a terminal tool, with a desktop app in beta, and its releases page showed v1.19.3 on 16 October 2026. Know before adopting: most permissions default to allow, while external_directory and doom_loop default to ask and .env files are denied for reading, so review the permission block in opencode.json before real work.

Aider is "AI pair programming in your terminal", Apache-2.0 licensed, and connects to many LLMs, including local models. Every time it edits a file it commits the change with a descriptive message, and it commits any existing uncommitted changes first. Know before adopting: the latest release on its GitHub releases page is v0.86.0, so check recent activity yourself before you standardise on it.

If you are comparing open source options in depth, our post on OpenCode alternatives goes further.

Do the work properly with the Safeguard CLI

The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It also works as a general assistant in your terminal. The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. With your approval it can find and read files, write files, edit code and run commands. And it writes code, not only scans it.

That combination is the point. The same assistant that edits your code can also see which of your dependencies are vulnerable, so a fix and a security check happen in one session instead of two tools.

Install

On macOS and Linux:

curl -fsSL https://cli.safeguard.sh/install | bash

On Windows, in PowerShell:

irm https://cli.safeguard.sh/install.ps1 | iex

It is a single static binary, so there is no Node, Python or JVM to install first. It runs on macOS, Linux and Windows, on x86_64 or arm64; Windows is x86_64 only. The download page lists CLI 1.4.0 with binaries for macOS on Apple Silicon and Intel, Linux on x86_64 and arm64, and Windows on x86_64.

First session, step by step

1. Commit or stash whatever you are working on, so the assistant starts from a clean state.
2. Move into the folder you want it to work in: cd ~/projects/invoice-tool.
3. Run safeguard with no arguments. That opens the interactive terminal.
4. Type /login. Your browser opens so you can sign in.
5. Type /permissions and choose Ask for your first session, so you see every action before it runs.
6. Ask a read-only question first, such as "what does this project do and how are the tests run".
7. Type /scan . to scan the current folder and see where you stand.

Writing and fixing code

Ask in plain language. The docs give three examples that show the range: "what's the latest file in ~/Downloads", "fix the lodash CVE in this repo" and "how many critical vulns do we have". The first is about your machine, the second is a code change, the third is about your Safeguard data. Tools that change things (writing a file, editing code, running a command) ask before they act, according to your approval mode. Type @ to attach a file from the folder you started in.

The search-runs-cli walkthrough shows the loop end to end: attach a computer running the Safeguard CLI and a folder, ask for a fix, review the diff and approve the command before it runs. The demo itself notes that computer work from Search is available and expanding.

Click through it at your own pace, or open it full screen.

Using your Claude, ChatGPT or Codex plan

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. /model shows or switches the AI model; for connecting a model, see the CLI docs. The second route is the Safeguard MCP server: connect Claude or ChatGPT to it, and you can ask about your findings from the chat you already use.

Approvals

/permissions sets one of three modes. Ask prompts before every action. Auto approves known actions and asks for anything new, and it is the default. Yolo approves everything. The current mode shows in the bar under the input. Start in Ask, move to Auto for repositories you know, and keep Yolo for throwaway environments.

Scans and CI

safeguard scan --dir . builds an SBOM and matches it against vulnerability databases; --repo, --image and --sbom cover a repository URL, a container image or an existing SBOM file. Results are JSON files under ./output, such as vuln.json and license.json. safeguard validate checks CycloneDX, SPDX and VEX documents. For pipelines, one non-interactive assistant turn looks like this:

safeguard exec "summarise the critical findings in this repository"

When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded. Policies and gates are evaluated in the platform, not by the CLI. More detail is in the Safeguard CLI as an assistant on your machine.

Worked examples: files, code edits and commands

Each example lists the prompt, what to expect, and the safety habit that goes with it. Outputs depend on your machine and account. All of them run in the Safeguard CLI's interactive terminal after /login.

1. Find a file you just downloaded

what's the latest file in ~/Downloads

A pure read, straight from the docs. Good for checking that the assistant can see your machine at all. Habit: notice that it read outside the project folder because you asked it to. Keep questions about other folders explicit.

2. Understand a project before touching it

read the README and the test config, then tell me how to run the tests

Still read-only. Habit: if the summary is wrong, correct it before any edit. An assistant that misreads the layout makes confident wrong edits.

3. Attach the exact file you mean

Type @, pick package.json (or go.mod, pom.xml, requirements.txt) from the list, then:

which of these dependencies are direct and which are only used in tests?

Habit: attaching removes guesswork about which file you meant, especially in a monorepo with several manifests.

4. Make a small, reviewable edit

add a --dry-run flag to scripts/cleanup.sh that prints what it would delete without deleting

Writing a file asks before it acts. In Ask mode you see the change before it lands. Habit: ask for one change per prompt. Small diffs are easy to read and easy to revert.

5. Run the tests and read the failures

run the test suite and tell me which tests fail and why

Running a command is one of the actions that asks first. Habit: read the command line in the prompt before approving it. If it is not the command you expected, decline and say what you want instead.

6. Fix a vulnerable dependency

how many critical vulns do we have

Then, for the one you care about:

fix the lodash CVE in this repo

The first prompt answers from your Safeguard data. The second edits the manifest and lockfile and may run your package manager, each with your approval. Habit: after the fix, run /scan . again and confirm the finding is gone, then run your tests.

7. Tidy a folder without losing anything

list the files in ./exports older than 30 days, and move them into ./exports/archive

This one runs commands that move files, which version control may not cover if the folder is gitignored. Habit: use Ask mode, ask for the list first, check it, and only then approve the move. Moving is safer than deleting; ask for deletes only when you have a backup.

8. Pick up tomorrow where you left off

cd ~/projects/invoice-tool
safeguard

/resume

/resume picks up the last session in that folder. Habit: start in the same folder, or the session you expect will not be there.

A ten minute safe setup you can copy

1. Initialise git in any folder you will let the assistant edit, and commit.
2. Add a .gitignore for build output and local secrets, so a stray git add cannot sweep them in.
3. Start the assistant inside the project folder, never in your home directory.
4. Use Ask for the first session in any new repository.
5. Ask one read-only question, then one small edit, then run the tests.
6. Review git diff yourself before committing what the assistant wrote.
7. Run /scan . after any dependency change.
8. Switch to Auto only once the routine actions are ones you would approve anyway.

From the terminal to the browser, desktop and phone

Files and commands are the terminal's job, but the same approval idea carries across Safeguard's other surfaces. The download page lists one platform on every surface: start in the terminal, continue on the desktop, check findings on your phone.

With the Safeguard Chrome extension, Search works in a browser tab you hand it, step by step. You set Ask, Auto or Yolo, it stops and asks before a risky step such as submitting a form (Allow once or Don't allow), and every step is kept on record. Browser control must be enabled for the workspace.

Click through it at your own pace, or open it full screen.

The rest of the lineup, as the download page lists it on 21 October 2026:

• Desktop app 3.2.2 for Windows 10 and 11 (x64 and ARM, no admin rights; not yet code-signed, so verify the SHA-256 before SmartScreen's More info, Run anyway), macOS 12 or later (signed and notarized) and Linux (AppImage, x86_64).
• Mobile apps for iPhone and iPad from the App Store, and for Android phones and tablets from Google Play or as a direct APK (1.0.2) with a SHA-256 to check.
• Extensions for VS Code, JetBrains and Open VSX, and browser extension 1.0.4 for Chrome-based browsers, Firefox, and Safari on iPhone and iPad; Safari on Mac is in Apple review.
• Nothing to install: the web interface, a cloud sandbox against a seeded demo repo (free for seven days, no card), and the hosted Cloud computer and Cloud CLI.

Common mistakes

Starting in your home directory. The assistant's idea of "this project" becomes everything you own. Start in the project folder. In the Safeguard CLI, that folder also decides what @ lists and what /resume restores.

Treating the tool's undo as a backup. Undo features vary. Claude Code's checkpoints do not track files changed by shell commands, and the docs say they are not a replacement for git. Commit before large changes, whatever tool you use.

Approving commands you did not read. The prompt is the safety control. If you approve on reflex, Ask mode is just slower Yolo. Read the full command, especially anything with rm, mv, chmod, curl or a package install.

Leaving the permissive mode on. Yolo in the Safeguard CLI, bypassPermissions in Claude Code and danger-full-access in Codex are meant for isolated environments. Switch back as soon as the throwaway task is done.

Big, vague prompts. "Clean up this repo" produces a large diff you cannot review. Ask for one change at a time and name the files.

Skipping the re-scan after a dependency change. An upgrade can resolve one advisory and introduce another. Run /scan . after every dependency edit. If another agent made the change, see checking coding agent changes with the Safeguard CLI.

Plugging a plan into a tool its provider does not allow. OpenCode's provider docs note that Anthropic prohibits using Claude Pro/Max plans through third-party plugins. Read your provider's terms before connecting a subscription anywhere.

FAQ

Can an AI assistant safely edit files on my computer?

Yes, if you keep control of scope, approvals and undo. Start it in one folder, choose a mode that asks before writes and commands, commit before large changes, and review the diff. The Safeguard CLI asks before writing a file, editing code or running a command, according to the mode you set with /permissions.

Can the Safeguard CLI do things that are not about security?

Yes, within its tools. It can find and read files, edit code and run commands on your machine, with your approval, and it can answer questions about your Safeguard data. The docs example "what's the latest file in ~/Downloads" is a plain machine question.

Can I keep using my Claude, ChatGPT or Codex subscription?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use. See the CLI docs or /model for connecting a model.

Which approval mode should I start with?

Ask, for any repository you have not worked in with an assistant before. Move to Auto, the default, once the routine actions are ones you would approve anyway. Use Yolo only in a disposable environment.

Does my source code leave my machine?

When the local runner runs platform scan jobs, your source code stays on your machine; only SBOMs and findings are uploaded.

What if the assistant makes a change I do not want?

Decline it at the prompt. If it already landed, git diff shows it and git restore drops it.

Can I use it in CI where nobody is there to approve?

Yes, for one non-interactive turn: safeguard exec "summarise the critical findings in this repository". safeguard scan and safeguard validate also run in scripts. Policies and gates are evaluated in the platform, not by the CLI.

Which platforms does it run on?

macOS, Linux and Windows, on x86_64 or arm64; Windows is x86_64 only. More on the assistant is in the security aware coding assistant post.

Try it yourself

This walkthrough is the install and first start: set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Ready to try it on your own files? Download the Safeguard CLI, start it in a project folder, type /login, set /permissions to Ask and give it a small first task. The full reference is in the CLI docs.

Quick check

Sources

• Safeguard CLI overview
• Safeguard CLI interactive terminal
• Safeguard downloads
• Claude Code overview
• Claude Code permission modes
• Claude Code checkpointing
• Claude Code licence file
• Codex CLI docs
• Codex sandboxing
• Codex repository and README
• OpenCode repository
• OpenCode licence file
• OpenCode releases
• OpenCode permissions
• OpenCode providers
• Aider repository
• Aider releases
• Aider git integration

Last reviewed: 21 October 2026.