Introduction
Moona is a local-first guardrail for AI coding agents. It sits between your agent and your real systems, evaluating commands before they run, blocking the catastrophic, holding the risky for your approval, and letting safe work continue uninterrupted.
What Moona does
AI coding agents are genuinely useful for development work. They write code, run commands, interact with databases, and manage infrastructure on your behalf. That speed comes with risk: an agent acting on a misunderstood instruction, or manipulated by a prompt-injection attack, can cause real damage before you notice.
Moona addresses this by intercepting the commands your agent issues and evaluating each one before it runs. When an action is safe, it passes through without interrupting your workflow. When an action is consequential, Moona holds it and asks you to decide. When an action is catastrophic (something irreversible against a production system), Moona stops it outright.
Every decision Moona makes is recorded in a signed audit log you can verify offline.
Who Moona is for
Moona is for developers and teams using AI coding agents such as Claude Code, Cursor, VS Code Copilot, or Codex who want a safety layer between agents and their databases, infrastructure, and project configuration.
You do not need to be a security expert to use Moona. Once it is set up in your project with moona setup, Moona helps guard consequential agent actions.
How Moona evaluates a command
When your agent issues a command, Moona resolves the target (for example, which database host a psql command is connecting to), then evaluates the action against your configured policy. The result is one of four outcomes:
Action proceeds
The action is within policy. It runs immediately without interrupting your workflow.
Agent asks to confirm
The action is lower-risk or uncertain. Your agent is asked to confirm before proceeding.
Held for your approval
The action is consequential but potentially legitimate. It waits until you explicitly approve it, from your terminal or your phone.
Refused outright
The action is catastrophic (for example, dropping a production table). It is blocked and cannot be approved.
What Moona does not do
Understanding Moona's boundaries is important for using it correctly:
- Moona never sends your source code or database data off your machine. Everything runs locally.
- Moona never runs your destructive SQL to measure it.
- The agent can request an action but cannot approve one. Approval always requires a human with access to your local keychain or an authenticated external account.
- Moona addresses the realistic risk of a runaway or prompt-injected agent. It operates within the trust boundary of your OS user account.
Moona is in early access and not publicly available yet. Join the waitlist →
Already have access? Start with Installation →