Memory That Says No.
Your Ai already remembers the command that took production down last month. CogmemAi Guard is the part that stops it from running that command again. Rules you save in memory are enforced before a shell command executes, and every turn ends with a review of what actually changed.
Advice Is Not Enforcement
Every memory product, ours included, can tell your Ai what went wrong last time. Under pressure, the Ai reads the note and does it anyway. A rule that lives only in context is a suggestion. Guard turns it into a stop.
You save a rule once
After an incident, write it down the way you already do: NEVER run `pkill -u www lsphp` on the shared host. It is a normal CogmemAi rule memory, saved with save_rule or from any client.
Guard compiles it
At session start the rule is turned into a pattern and cached on your machine. No code to edit, and the check itself makes no network call, so it costs nothing per command.
The command never runs
When your Ai tries it, inside an ssh string or not, the command is denied before it executes, with your own words as the reason and a way forward: run it yourself, or remove the rule.
Three Checks, One Engine
Guard ships inside the cogmemai-mcp package you already install. It never calls a language model, never edits your code, and fails open: if anything inside it breaks, your command runs untouched.
Before a command runs
Six built-in rules cover the operations with no good unattended use: rewriting a whole crontab from a pipeline, destructive SQL sent to a live database, recursive deletes outside temp and build paths, force-pushing a shared branch, piping a download into a shell, and killing shared server workers by name. Then your remembered rules run.
Inside the wrapper
The payload of ssh host "...", bash -c "...", and a heredoc fed to a shell runs on the far side exactly as written, so it is judged exactly as if typed directly. Quoted data and heredoc bodies are stripped first, so writing a dangerous command into a notes file is not the same as running it.
After every turn
A review of what actually changed in the working tree: credentials pasted into tracked source, version strings that disagree across release files, deleted files, large net deletions, a function newly defined in two places, and remembered gotchas about the files that were touched. Silence is the correct output for a clean turn.
Every Tool That Opens a Shell
Claude Code gets Guard as hooks, installed by the setup wizard. Everything else gets it at the shell.
Claude Code
A PreToolUse hook on Bash and a Stop hook, wired by npx cogmemai-mcp setup. Already set up? Run cogmemai-mcp guard install.
Cursor, Codex, Gemini CLI, Cline, scripts
They all end up running bash -c "<command>". One command, cogmemai-mcp guard shell-install, makes every such shell hand its command to Guard before it runs. Same rules, same log. zsh too.
The log
Every verdict, including the silent allows, is written locally with secrets redacted. cogmemai-mcp guard status shows what fired and how often, so precision is something you can measure rather than something we claim.
Turn It On
If you use CogmemAi with Claude Code, you may already have it. Check with the first command.
See what is active
cogmemai-mcp guard statusLists the remembered rules cached for this project and the verdict counts so far. Not installed? npm install -g cogmemai-mcp@latest then cogmemai-mcp guard install.
Save a rule
save_rule: "NEVER run `wp cron event run` from the system crontab, it runs under the wrong PHP."A backticked command that follows NEVER, DO NOT, or MUST NOT becomes a rule. Want an exact pattern? Add a line reading GUARD: <regex>. Want a rule to stay advisory? GUARD: off.
Cover every other tool
cogmemai-mcp guard shell-installOptional. Guards every bash -c and zsh -c on the machine, whichever tool opened it. guard shell-remove undoes it.
What Guard Is Not
We would rather you trust it for the right reasons.
Not a sandbox
Guard judges commands; it does not contain them. Git, backups, and review are still the real undo. Guard makes the mistake you already made once much harder to make twice.
Not a mind reader
A remembered rule only becomes enforcement when it names a command. Prose about being careful stays advice. That is deliberate: a guard that guesses gets switched off within a week.
Not everywhere yet
The shell adapter judges the -c string, not the body of a script file, and does not cover sh -c on systems where sh is dash. Interactive terminals are untouched.
Stop Paying for the Same Mistake Twice
Guard is included with every CogmemAi plan, Free included. Install the memory layer and the enforcement comes with it.