{"repo":"ops0-ai/ops0-cli","free":true,"listed":false,"github":"https://github.com/ops0-ai/ops0-cli","clone":"git clone https://github.com/ops0-ai/ops0-cli.git","description":"Stop your AI agent from shipping insecure IaC. ops0 CLI sits between Claude Code, Codex or Gemini and your cloud, scanning every .tf the agent writes and blocking destroy commands before they run.","language":"Go","stars":75,"topics":["terraform","ai-agents","audit-log","claude-code","cli-tool","codex","devsecops","gemini-cli","golang-cli","governance"],"license":null,"category":"ai-agents","readme_excerpt":"ops0 CLI Policy, lint, vulnerability, and cost guardrails for AI coding agents. Sits in front of Claude Code, Codex and Gemini CLI. Every time the agent finishes writing IaC, the whole working directory gets validated, linted, policy-checked, security-scanned, and cost-estimated server-side. Failures come back as a failed tool call so the agent self-remediates. Destructive commands are blocked before they run. Quick start · What runs at end-of-turn · How agents trigger it · Monorepos · ops0-scan.md · Commands --- Why this exists When humans write infrastructure, policy gates fire on the PR. CI runs the scanner, someone gets paged, the PR sits in review for hours. When an agent writes infrastructure, that loop is broken. The agent will happily generate a public S3 bucket, an open security group, or an oversized EC2 fleet. By the time CI catches it, the agent has moved on. ops0 sits in front of the agent. It runs your organization's checks when the agent finishes a turn, blocks destructive commands before they execute, tells the agent how much its IaC will cost per month, and gates the change against the project's budget. What it does --- --- Validates at end-of-turn, not per file save A Stop hook fires when the agent finishes its turn. ops0 validate runs once against the complete working directory. Validating mid-construction was noisy on half-written modules; validating the finished module is clean. Blocks destroy commands A PreToolUse hook intercepts terraform destroy , tofu","default_branch":null,"files":null,"tree":[],"storefront":"/r/ops0-ai","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/ops0-ai/ops0-cli/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}