Garuda reads, edits and runs your code from the terminal, with the model you choose. Commands run in an OS sandbox that writes only in your project, temp folders and caches, edits ask first, and every decision goes to an audit log.
npm install -g @garuda-agent/garuda› Fix the failing cart test ● read_file src/cart.ts ⎿ 48 line(s) ● bash pnpm test cart [sandbox] ⎿ exit 1 · 1 failed ● edit_file src/cart.ts ╭ Allow this edit? │ - return total - discount; │ + return Math.max(0, total - discount); ╰ once · session · deny ● bash pnpm test cart [sandbox] ⎿ exit 0 · 12 passed A discount larger than the total made it negative. It is now clamped at zero, and all 12 tests pass. [done · 4 steps · 18.2k tokens · $0.04]
Safety first
A coding agent runs commands and edits files for a model. Garuda puts each of those actions through checks that the model cannot turn off.
Seatbelt on macOS, bubblewrap on Linux. Commands write only in the project, temp folders and package caches. Home secrets stay unreadable, and there is no network by default. Without a sandbox, each command asks first, unless your allow rule covers it.
An edit shows its diff: allow it once, for the session, or not at all, or accept single hunks. Commands in the sandbox run with no question, inside its limits; a command outside it asks unless your allow rule covers it. /undo restores the files in its snapshot. Plan mode only reads.
When you open the network, commands reach only the hosts you list, through Garuda's own proxy. Any other host asks first. IP addresses and private addresses are refused.
A managed file and ~/.garuda set denied commands and paths, a required sandbox, allowed models and step and token limits. They also hold for subagents and hooks.
Every permission decision, tool run and hook goes to a log outside the project. Secrets are redacted. /audit verify finds a changed, removed or inserted line.
Hooks, MCP servers, slash commands, skills, agents and settings that loosen safety ask once. The answer is pinned to a hash, so a change asks again.
Everyday work
The safety model costs you nothing in the daily flow. Commands in the sandbox run without a question.
Reviewed by itself
Garuda reviewed seven areas of its code in plan mode, read only. Each finding was checked by hand, and each fix came with a test that fails without it. One finding was high: after Ctrl-C at an approval question, every later message of the chat failed.
How the review went →Get started
Install it with Homebrew or npm (Node 22 or later). Garuda runs on macOS and Linux, and is open source under the Apache-2.0 license.
# install it with npm npm install -g @garuda-agent/garuda # or with Homebrew brew tap madhu-sv/garuda brew trust --formula madhu-sv/garuda/garuda brew install garuda # once: choose a model and enter its key garuda setup # use it in your project cd ~/my-project && garuda