Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
a guard that blocks catastrophic agent actions
| Date | Stars |
|---|---|
| 2026-07-31 | 458 |
| 2026-08-11 | 464 |
| 2026-08-18 | 467 |
| 2026-08-19 | 470 |
| 2026-08-20 | 473 |
| 2026-08-31 | 476 |
| 2026-09-01 | 477 |
| 2026-09-02 | 480 |
| 2026-09-09 | 481 |
| 2026-09-12 | 482 |
| 2026-09-14 | 483 |
| 2026-09-16 | 484 |
| 2026-09-18 | 485 |
| 2026-09-19 | 486 |
| 2026-09-20 | 486 |
Today
— stars today
This week
+4 stars this week
This month
+13 stars this month
Momentum
39.0
growth rate 0.83%/day
<p align="center">
<img src="assets/logo-round.png" alt="nah" width="280">
</p>
<p align="center">
<strong>expensive mistakes stop here</strong><br>
a guard that blocks catastrophic agent actions
</p>
<p align="center">
<a href="https://nahguard.ai/">nahguard.ai</a> •
<a href="#it-knows-a-disaster-when-it-sees-one">what it blocks</a> •
<a href="#deterministic-programs-not-llm-judges">how it decides</a> •
<a href="#install">install</a> •
<a href="#extensions-are-just-programs-you-build">extend</a> •
<a href="docs/threat-model.md">threat model</a>
</p>
<p align="center">
claude code · codex · cursor · pi ·
<a href="#install">+ 11 more</a>
</p>
nah is a guard that sits in your coding agent's hook path and reads tool
calls before they run. It blocks the calls it can prove are disasters and
leaves everything else to your runtime.
nah is just one Rust binary: a verdict is
deterministic and needs no LLM.
Extensions are just programs. Point your agent to nah's docs and ask it to build a custom nah guard.
## It knows a disaster when it sees one.
46 guards, 29 on by default, covering seven classes of disaster: **execution
hijacks**, **secret theft**, **filesystem destruction**, **git disasters**,
**infrastructure, storage, and backup teardown**, **package-registry operations**,
and **host power and service-stop actions**.
| Guard | Blocks |
| --- | --- |
| `exec-remote` | Execution of a payload visibly obtained from the network. |
| `exec-decoded` | Execution reached from a visible decode stage. |
| `exec-obfuscated` | Encoded, pattern-selected, or unresolved execution. |
| `exec-network-shell` | Shells attached to a network connection, including netcat, socat, and shell redirection. |
| `secrets-env` | Reads of `.env` files and sensitive basenames, plus direct output of catalogued credential environment variables. |
| `secrets-credentials` | Reads or writes of private-key and credential-store paths. |
| `secrets-exfil` | A visible flow from a sensitive source to a network stage. |
| `secrets-store-delete` | Remaining reviewed secret-store deletion with recoverable or context-dependent semantics. Off by default. |
| `secrets-store-destroy` | Proven permanent secret-store destruction: Vault version/metadata/engine removal, AWS force and SSM deletion, Google whole-secret deletion, Azure purge, and Doppler configuration deletion. |
| `secrets-store-read` | Reviewed value reads across common secret-manager CLIs. |
| `fs-system-tree` | Deletion, proven root-entry relocation, or recursive permission changes selecting the filesystem root or a system tree. |
| `fs-home` | Deletion or recursive permission changes selecting the home root. |
| `fs-outside-workspace-delete` | Recursive deletion outside the active project, except under reviewed temporary roots. Off by default. |
| `fs-permission-weaken` | `chmod` modes that provably grant world-write or setuid/setgid permission. Off by default. |
| `fs-project-root` | Concrete Project-scoped recursive deletion or known recursive permission changes selecting the exact project root or its exact `*`, `.*`, or `{*,.*}` root-wide patterns. `find -delete` without an explicit start path has no modeled target. |
| `fs-raw-device` | Visible writes to raw storage devices and the sysrq trigger. |
| `fs-volume-destroy` | Definite logical-volume, storage-pool, and live ZFS dataset destruction. |
| `fs-forkbomb` | Structurally recognized shell fork-bomb patterns. |
| `fs-auth-identity` | Modification or deletion of reviewed host authentication, identity, and privilege-policy files, including recursive deletion of their parent directories. |
| `fs-shell-profile` | Changes to reviewed user shell profile paths. Off by default. |
| `fs-startup-management` | Reviewed persistent `systemctl`, `launchctl`, and `crontab` management commands. Off by default. |
| `fs-startup-persistence` | Changes to reviewed service, schedule, login, autosExcerpt of 12,342 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:f9cd31b177066f29, llm:Description: 'You should sandbox your agents. This is for when you don't.' Repository name 'nah' suggests tool for running agents without sandboxing — likely agent/agents-related code for AI. Language: Python. No topics or README provided.
matched fp:f9cd31b177066f29, llm:Description: 'You should sandbox your agents. This is for when you don't.' Repository name 'nah' suggests tool for running agents without sandboxing — likely agent/agents-related code for AI. Language: Python. No topics or README provided.