{
  "aid": "shellpermit.shellpermit.schemasure.com",
  "name": "ShellPermit",
  "type": "index",
  "description": "ShellPermit tokenizes a candidate bash command — quoting, escaping, pipelines, command and process substitution, heredocs, redirections — walks the result, and reports whether it complies with the policy you supply: allowed roots, network egress, destructive operations, privilege escalation, command allow and deny lists. Every segment of a chain is evaluated and the verdict is the worst across them. Detection is structural, so bundled flags, $IFS, base64, unicode look-alikes and quoting games cannot hide a construct from it. On a compliant command it can issue a signed Ed25519 permit, valid for 60 seconds, bound to the sha256 of the canonical command — which collapses quoting and flag order but preserves every operand, so a permit for `rm -rf /tmp/build` can never authorise `rm -rf /`. What it cannot do: it never runs anything and never sees your filesystem, so it cannot resolve a symlink, cannot know which files exist, and cannot see your aliases, shell functions, or PATH. It is defence in depth alongside a sandbox and a least-privilege user, not a replacement for either.",
  "image": "https://shellpermit.schemasure.com/icon.svg",
  "tags": [
    "shell",
    "bash",
    "command",
    "guard",
    "policy",
    "agent-safety",
    "sandbox",
    "permit",
    "x402",
    "deterministic"
  ],
  "created": "2026-08-03",
  "modified": "2026-09-19",
  "specificationVersion": "0.18",
  "apis": [
    {
      "aid": "shellpermit.v1.guard.shell",
      "name": "ShellPermit — Check a bash command against an execution policy and optionally issue a signed permit",
      "description": "Decide whether an agent-authored bash command complies with an execution policy, using a real shell tokenizer rather than pattern matching. Catches recursive deletes, force pushes, cluster and infrastructure teardown, raw device writes, path escapes, privilege escalation, and curl-piped-to-shell through pipelines, substitutions, quoting games and base64. Returns reason codes with spans and an optional short-lived permit bound to the exact canonical command. Never executes anything.",
      "humanURL": "https://shellpermit.schemasure.com/docs",
      "baseURL": "https://shellpermit.schemasure.com/v1/guard/shell",
      "tags": [
        "shell",
        "bash",
        "command",
        "guard",
        "policy",
        "agent-safety",
        "sandbox",
        "permit",
        "x402",
        "deterministic"
      ],
      "properties": [
        {
          "type": "OpenAPI",
          "url": "https://shellpermit.schemasure.com/openapi.json"
        },
        {
          "type": "x402",
          "url": "https://shellpermit.schemasure.com/.well-known/x402.json"
        },
        {
          "type": "Pricing",
          "url": "https://shellpermit.schemasure.com/.well-known/pricing.json"
        },
        {
          "type": "Benchmarks",
          "url": "https://shellpermit.schemasure.com/.well-known/benchmarks.json"
        },
        {
          "type": "LLMs",
          "url": "https://shellpermit.schemasure.com/llms.txt"
        }
      ]
    }
  ]
}