Stop AI agents before they break things.

Install Antelog. It checks every command your agent wants to run before it runs, and stops destructive ones like rm -rf on your home folder, DROP TABLE, force-pushing to main, deleting cloud databases, and reading .env files. Install is one command and needs no account.

Yes. It stops DROP TABLE, DROP DATABASE, TRUNCATE, DELETE with no WHERE, dropdb, and deleting cloud databases and volumes through cloud command-line tools or APIs: the kind of action that wiped the PocketOS production database and its backups in April 2026.

Commands you run yourself, other programs, and agents Antelog isn’t connected to (unless they ask through antelog check). Through MCP servers it stops delete, reset and restore calls to database, cloud and git servers, and destructive SQL; other MCP tools get the AI check. If you turn the AI check off (or it can’t be reached), a harmful action that matches no rule is allowed, so add your own rules for anything specific to your setup. Some tools have their own gaps: Copilot’s cloud agent isn’t covered, Gemini CLI skips hooks in folders you haven’t trusted, Gemini CLI, Qwen Code and Cline let an action run if they stop Antelog’s hook before it answers or if hooks are turned off, and in OpenCode and Kilo Code nothing is checked if the plugin fails to load. The docs list each tool’s limits.

Usually yes. Dropping or emptying a local test, dev or scratch database is normal agent work, so the AI check lets it through. Destructive commands aimed at production are stopped and you decide; deleting cloud databases, volumes or backups is always stopped. When Antelog isn’t sure, it asks you instead of guessing.

Rule checks run on your computer and add milliseconds. Everything the rules don’t stop gets a quick AI check, which usually adds under half a second. You can turn it off.

In Claude Code it stops a flagged command and asks you to allow or decline it, so you stay in control. In Cursor, and when nobody is there to answer (for example claude -p), it blocks it. The tools new in 0.9.25 always block, because they can’t ask. In Claude Code (2.1.295 or newer) and Cursor, if Antelog itself fails, the action is blocked.

In Claude Code (2.1.295 or newer) and Cursor, the action is blocked. Your agent waits instead of running unchecked. Codex blocks too, except when the antelog program can’t start at all or its hooks weren’t approved with /hooks (antelog doctor checks this). Some of the tools new in 0.9.25 let an action run if they stop Antelog’s hook or hooks are switched off; the docs list each tool’s limits.

No. The agent can’t change Antelog’s settings, delete its record, stop it, or uninstall it. You still can. In some tools new in 0.9.25, the tool’s own settings (or a project you open) can switch its hooks off, and Antelog can’t fully stop that; the docs list each tool’s limits.

Only for the free AI check: a command that changes something and that no rule recognizes, plus the text of any script it runs, with passwords and keys removed, goes to Antelog’s AI check server. The server answers yes or no and does not keep the command. Your log stays on your computer unless you connect it to your online dashboard. To turn the AI check off, write the word off into ~/.antelog/hosted-ai-check.

Claude Code, Codex and Cursor. GitHub Copilot (the Copilot CLI, the Copilot app and VS Code’s Copilot agent), Gemini CLI, Qwen Code, Cline, OpenCode and Kilo Code from Antelog 0.9.25. Any other agent can ask Antelog first through one command (antelog check). Antelog guards the tool, not the model, so any model you run inside these tools is covered.

Yes. Blocking is free and the same on every plan, on your laptop and in production. Pro ($25 a month or $199 a year) adds 50,000 AI checks a month, 90 days of history, and Slack and email alerts. Team adds more people, shared rules and an audit log.

The code isn’t public, but everything Antelog decides is on your computer: every action and every block is written to a tamper-evident log you can read with antelog log and antelog blocked.