agentcurfew
Policy
agentcurfew.policy.json at the root of a project sets what its agent components may be. agentcurfew init writes one from what the project has now: the skill sources and servers it uses, and the strict value of every setting the project already meets; a setting it does not meet yet is left loose and listed, and findings that are not about the policy, such as a secret, still fail; agentcurfew doctor checks it against schema.json, and scan, lock and verify refuse to run with a policy that does not follow it.
Settings that are true or false move the level of a rule (a finding then names the setting); lists of allowed sources and servers feed the rule out-of-policy; exclude leaves paths out of everything; exceptions accept findings, each with a reason, and with until only to that date.
| Field | Type | Meaning |
|---|---|---|
$schema | string | The address of this schema, for editors. |
version | 1, required | Version of the policy format. |
failOn | "critical", "high", "medium", "low", "none" | Default --fail-on of agentcurfew scan: the lowest level that makes it exit with 1. The flag wins over it. |
skills | object | Rules for skills. |
skills.allowSources | list of strings | Where skills may come from: the source field of skills-lock.json, matched as a glob (* within a segment, ** across segments). local allows skills that skills-lock.json does not list. When set, any other skill is out of policy. |
skills.allowExecutables | boolean | false makes a skill that bundles programs or scripts out of policy. |
mcp | object | Rules for MCP servers. |
mcp.requirePinnedVersions | boolean | true raises unpinned-mcp-server to high; false lowers it to info. |
mcp.allowServers | list of strings | Which servers may be configured: the package or image a launcher fetches, or the server's address, matched as a glob. local allows servers started from a local command. When set, any other server is out of policy. |
mcp.denyPlainHttp | boolean | true keeps plain-http-mcp at high; false lowers it to info. |
hooks | object | Rules for hooks and automatic tasks. |
hooks.allowNetwork | boolean | false raises hooks that open a network connection to high; true lowers them to info. Downloads that are run stay high either way. |
hooks.allowAutoRunOnOpen | boolean | false raises auto-run-on-open to high; true lowers it to info. |
contextFiles | object | Rules for context files and other text the agent reads. |
contextFiles.denyHiddenUnicode | boolean | true keeps hidden-unicode as it is; false lowers it to info. |
exclude | list of objects | Paths that are not scanned, locked or verified at all. |
exclude[].path | string, required | A glob relative to the project, with / separators. |
exclude[].reason | string, required | Why the path is left out. |
exceptions | list of objects | Findings that are accepted, each with a reason, until a date when one is given. |
exceptions[].rule | "hidden-unicode", "unpinned-mcp-server", "plain-http-mcp", "secret-in-config", "dangerous-hook-command", "unpinned-launcher", "auto-run-on-open", "permission-bypass", "broad-shell-permission", "env-override", "plugin-marketplace", "remote-instructions", "obfuscated-content", "persistence-instruction", "drift", "skills-lock-mismatch", "out-of-policy", "mcp-package", required | The id of the rule; agentcurfew explain lists what each finds. |
exceptions[].path | string, required | A glob of the files the exception covers. |
exceptions[].reason | string, required | Why the finding is accepted. |
exceptions[].until | date (YYYY-MM-DD) | YYYY-MM-DD: from the day after, the finding is reported again. |
doctor | object | Settings of agentcurfew doctor. |
doctor.failOn | "error", "warning", "info", "none" | The lowest level that makes agentcurfew doctor exit with 1; warning by default. |
Globs: * stays within a path segment, ** crosses segments, ? is one character, and a glob that names a folder covers everything below it.