rv

Authorize agent actions before they run

rv is a hook-grade shell guard for coding agents. It sits on the host hook wire — not in the prompt, not after the fact — and decides allow or deny before a shell command runs.

Agents generate actions. rv authorizes them before they run.

v0.1 ships for Pi, Grok, and OpenCode on macOS 26, Apple Silicon. One command: rv.

What it does

  • Evaluates destructive git and filesystem commands against local packs
  • Denies malformed hook JSON
  • Honors a one-shot grant (rv allow-once) when the adapter sends cwd
  • Denies known secret paths such as .env and SSH keys
  • Wires host adapters with rv setup

Install

curl -fsSL https://rykanv.com/install | sh

rv setup

rv doctor

rv test "git reset --hard"

rv test "rm -rf /"
rv explain "rm -rf /"

Then run rv test 'git reset --hard' after setup.

Next