Moon Guard is an optional guard that inspects the agent’s actions before they run. It blocks destructive commands, reading your Moon AI session, and sending real secrets outside your machine.
Turn Moon Guard on or offLink to the Turn Moon Guard on or off section
moon guard on
moon guard off
moon guard # show the status and where it comes fromThe setting applies to the next launches of moon. For a single launch, use the MOON_GUARD variable, which takes precedence over the setting:
MOON_GUARD=on moon$env:MOON_GUARD = "on"
moonmoon doctor also shows whether Moon Guard is on.
What is blockedLink to the What is blocked section
When Moon Guard is on, these commands are refused. The agent receives a message such as “[Moon Guard] Commande bloquée : fork bomb. Exécutez-la vous-même hors de l’agent si vous êtes sûr.” (command blocked: fork bomb; run it yourself outside the agent if you are sure).
| Category | Examples |
|---|---|
| Recursive deletion of a critical target | rm -rf /, a system folder, ~, $HOME, *, . |
| Recursive deletion of an opaque target | rm -rf $(…), a path that climbs out of the project (../../) |
| Mass deletion | find , find |
| Writing directly to a disk | redirection to /dev/sd* or /dev/nvme*, dd of=/dev/…, mkfs |
| Running downloaded code | curl or wget output piped to a shell or to python, perl, ruby, node; eval |
| Shutting down the machine | shutdown, reboot, halt, poweroff, systemctl |
| Fork bomb | a shell function that keeps relaunching itself |
Moon Guard also blocks:
- reading your Moon session and settings: the Moon CLI state folder,
~/and the system keychain, including through recursive scans (.config/ moon grep -r,find,tar…), wildcards, symbolic links or Windows short names; - sending a real secret restored by Moon Blur: through a network command, a DNS query, a
git pushor another remote Git operation, an interpreter with inline code (python -c,node -e,powershell…), a web page or web search, or an MCP tool.-Command
What is flaggedLink to the What is flagged section
These commands are risky but common. Moon Guard shows a warning and asks you to confirm or refuse; in automatic approval mode, they go through without confirmation:
rm -rfon an ordinary target;gitandpush --force git;push --force-with-lease git;reset --hard chmod 777on a system path;history -c(clears the shell history).
External content markedLink to the External content marked section
When Moon Guard is on, the content of a web page the agent reads is presented to it framed as untrusted external content: data to analyze, never instructions to follow. This reduces the risk that a booby-trapped page pushes the agent to act against you.
If Moon Guard does not loadLink to the If Moon Guard does not load section
When Moon Guard is on, Moon CLI sends nothing to the model until the guard is loaded. If it fails to load, the agent shows: “La protection de Moon CLI (Moon Guard) ne s’est pas chargée : par sécurité, rien n’a été envoyé. Relancez « moon » ; si cela persiste, lancez « moon doctor ».” (Moon CLI’s protection, Moon Guard, did not load: to be safe, nothing was sent; run moon again, and if the problem persists, run moon doctor).
LimitsLink to the Limits section
- Moon Guard reads the text of commands. An obfuscated command (variables, encodings) can get past it: it is not a sandbox.
- It adds to your confirmations; it does not replace them. Keep normal mode on a project you do not know.
- A blocked command is still possible: run it yourself, outside the agent, if you are sure.