{"slug": "nah", "name": "nah", "category": "ai", "category_name": "AI tools and apps", "description": "", "recommenders": 3, "commenters": 3, "warners": 0, "score": 2.588, "rising": -0.98, "first": "2026-03-11", "latest": "2026-03-12", "why": "this looks like a well thought out project, and I love the name!", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 0, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "this looks like a well thought out project, and I love the name!", "kind": "", "icon": false, "domain": null, "github_repo": "github.com/manuelschipper/nah", "official_url": "https://github.com/manuelschipper/nah", "pricing": "", "aliases": ["nah"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 757625232, "item_id": 47351577, "url": "https://news.ycombinator.com/item?id=47351577", "by": "ozgurozkan", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "The \"context\" classification category in nah is particularly interesting", "excerpt": "\"Maintaining a deny list is a fool's errand\" \u2014 this is exactly right, and the semantic classification approach (what does this tool call actually do, not what is it named) is much more robust. The line \"200 IQ Opus can find a way around it\" is worth taking seriously as a design constraint though. A deterministic classifier run in milliseconds gives you defense-in-depth, but a sufficiently capable model can craft tool", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}, {"id": 757582209, "item_id": 47348888, "url": "https://news.ycombinator.com/item?id=47348888", "by": "felix9527", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "composing nah's classification decisions with a verifiable log", "excerpt": "Sure \u2014 it's at https://github.com/PunkGo/punkgo-jack It hooks into PostToolUse, PreToolUse, SessionStart/End, and UserPromptSubmit. Each event gets submitted to a local kernel that appends it to an RFC 6962 Merkle tree. You can then verify any event with an inclusion proof, or check log integrity between two checkpoints with a consistency proof. The verify command works offline \u2014 just needs the checkpoint and tile ha", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}, {"id": 757512832, "item_id": 47344552, "url": "https://news.ycombinator.com/item?id=47344552", "by": "stingraycharles", "date": "2026-03-11", "version": null, "stance": "recommend", "quote": "this looks like a well thought out project, and I love the name!", "excerpt": "I\u2019m a bit confused: \u201cWe needed something like --dangerously-skip-permissions that doesn\u2019t nuke your untracked files, exfiltrate your keys, or install malware.\u201d Followed by: \u201cDon't use --dangerously-skip-permissions. In bypass mode, hooks fire asynchronously \u2014 commands execute before nah can block them.\u201d Doesn\u2019t that mean that it\u2019s limited to being used in \u201cdefault\u201d-mode, rather than something like \u201c\u2014dangerously-skip-", "context": "", "use_case": "Claude Code permission guard", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["claude code permission guard"], "compared": [{"slug": "claude-code", "name": "Claude Code", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 796956880, "item_id": 49809805, "url": "https://news.ycombinator.com/item?id=49809805", "by": "schipperai", "date": "2026-09-22", "version": null, "stance": "recommend", "quote": "I have a coding agent guard OSS tool [1] and I use Claude to build it.", "excerpt": "They have for sure improved the safeguard classifier. I have a coding agent guard OSS tool [1] and I use Claude to build it. When Fable first came out, I was simply unable to do any work with it. Nowadays their classifier triggers but very rarely. [1]: https://github.com/manuelschipper/nah", "context": "", "use_case": "coding agent guard", "switched_from": "", "story": "Claude Opus 5.5"}, {"id": 795939856, "item_id": 49746241, "url": "https://news.ycombinator.com/item?id=49746241", "by": "schipperai", "date": "2026-09-17", "version": null, "stance": "recommend", "quote": "I\u2019m working on nah, a coding agent guard to block catastrophic tool calls.", "excerpt": "I\u2019m working on nah, a coding agent guard to block catastrophic tool calls. It\u2019s easily extensible, has a nice simple TUI, and is resilient to an adversarial agent that tries to remove the guard. https://github.com/manuelschipper/nah", "context": "", "use_case": "blocking dangerous agent tool calls", "switched_from": "", "story": "Ask HN: What are you working on? (September 2026)"}, {"id": 769445472, "item_id": 48090342, "url": "https://news.ycombinator.com/item?id=48090342", "by": "schipperai", "date": "2026-05-10", "version": null, "stance": "recommend", "quote": "A better permissions layer for coding agents.", "excerpt": "A better permissions layer for coding agents. The tool works like auto-mode for Claude Code, so you can stay in the flow and only get prompted to allow or deny tool calls when it truly matters, but it is fully deterministic. My benchmarks surfaced that most Bash calls don\u2019t need an LLM to be classified as safe, ambiguous, or dangerous. A deterministic classifier can auto-allow or block 95% of Bash tool calls as safe ", "context": "", "use_case": "deterministic permission policies for agents", "switched_from": "", "story": "Ask HN: What Are You Working On? (May 2026)"}, {"id": 766713120, "item_id": 47919570, "url": "https://news.ycombinator.com/item?id=47919570", "by": "schipperai", "date": "2026-04-27", "version": null, "stance": "recommend", "quote": "\u201cnah\u201d is a context aware permission layer that clasifies commands based on what they actually do", "excerpt": "Agent permissions layer are broken. We need better a permissions layer that doesn\u2019t get in the way but stops destructive commands. Devs get pushed into running yolo mode cause classifying allow / deny by command is not enough. A sandbox would not have prevented this either. \u201cnah\u201d is a context aware permission layer that clasifies commands based on what they actually do nah exposes a type taxonomy: filesystem_delete, ", "context": "", "use_case": "agent command permission layer", "switched_from": "", "story": "An AI agent deleted our production database. The agent's confession is below"}, {"id": 757625024, "item_id": 47351564, "url": "https://news.ycombinator.com/item?id=47351564", "by": "schipperai", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "In my own work the LLM only fires for 5% of the commands", "excerpt": "Thanks! In my own work the LLM only fires for 5% of the commands - big token savings. When it does kick in it gets: the command itself, the action type + why it was flagged - for example 'lang_exec = ask', the working directory and project context so it knows if its inside the project, and recent conversation transcript - 12k charts by default and configurable. The transcript context is pulled from Claude Code's JSON", "context": "", "use_case": "permission guard for Claude Code", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}, {"id": 757585808, "item_id": 47349113, "url": "https://news.ycombinator.com/item?id=47349113", "by": "schipperai", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "nah is just another layer that catches the 95% that's structurally classifiable.", "excerpt": "Good catch, that's a legit bypass nah strips env var prefixes before classifying the command but doesn't inspect their values for embedded shell execution, I'll fix it: https://github.com/manuelschipper/nah/issues/6 On the broader write-then-execute point - two improvements are coming: - Script execution inspection: when nah sees python script.py, read the file and run content inspection and LLM analysis before execu", "context": "", "use_case": "Claude Code permission guard", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}], "threads": [{"url": "https://news.ycombinator.com/item?id=47343927", "title": "Show HN: A context-aware permission guard for Claude Code", "mentions": 7}, {"url": "https://news.ycombinator.com/item?id=49803892", "title": "Claude Opus 5.5", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49686380", "title": "Ask HN: What are you working on? (September 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48085993", "title": "Ask HN: What Are You Working On? (May 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47911524", "title": "An AI agent deleted our production database. The agent's confession is below", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 3}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 757625232, "item_id": 47351577, "url": "https://news.ycombinator.com/item?id=47351577", "by": "ozgurozkan", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "The \"context\" classification category in nah is particularly interesting", "excerpt": "\"Maintaining a deny list is a fool's errand\" \u2014 this is exactly right, and the semantic classification approach (what does this tool call actually do, not what is it named) is much more robust. The line \"200 IQ Opus can find a way around it\" is worth taking seriously as a design constraint though. A deterministic classifier run in milliseconds gives you defense-in-depth, but a sufficiently capable model can craft tool", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}, {"id": 757582209, "item_id": 47348888, "url": "https://news.ycombinator.com/item?id=47348888", "by": "felix9527", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "composing nah's classification decisions with a verifiable log", "excerpt": "Sure \u2014 it's at https://github.com/PunkGo/punkgo-jack It hooks into PostToolUse, PreToolUse, SessionStart/End, and UserPromptSubmit. Each event gets submitted to a local kernel that appends it to an RFC 6962 Merkle tree. You can then verify any event with an inclusion proof, or check log integrity between two checkpoints with a consistency proof. The verify command works offline \u2014 just needs the checkpoint and tile ha", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}, {"id": 757512832, "item_id": 47344552, "url": "https://news.ycombinator.com/item?id=47344552", "by": "stingraycharles", "date": "2026-03-11", "version": null, "stance": "recommend", "quote": "this looks like a well thought out project, and I love the name!", "excerpt": "I\u2019m a bit confused: \u201cWe needed something like --dangerously-skip-permissions that doesn\u2019t nuke your untracked files, exfiltrate your keys, or install malware.\u201d Followed by: \u201cDon't use --dangerously-skip-permissions. In bypass mode, hooks fire asynchronously \u2014 commands execute before nah can block them.\u201d Doesn\u2019t that mean that it\u2019s limited to being used in \u201cdefault\u201d-mode, rather than something like \u201c\u2014dangerously-skip-", "context": "", "use_case": "Claude Code permission guard", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}]}