AI agents break things. Rollcage puts them back.
A Mac menu-bar app that snapshots your projects the moment Claude Code, Codex or Cursor starts, restores whatever they delete, and keeps them out of your .env files.
$29 launch price ends on 18 October.36 spots left at $29.
7 days free, then $29 once. macOS 14 Sonoma or later. Signed and notarized by Apple.
From “oh no” to “never mind” in one click.
- 1
An agent starts
Rollcage notices Claude Code, Codex, Cursor or any agent you list the moment it launches in a project.
- 2
Your project is cloned instantly
An APFS copy-on-write snapshot takes well under a second and almost no disk space, then again every 15 minutes while the agent works.
- 3
Something goes wrong
Files start disappearing. Rollcage counts them as they go and alerts you before you even look at the terminal.
- 4
You put it back
Pick the snapshot, see exactly what was deleted or changed, and restore the files you want, or the whole folder.
Your secrets stay yours.
The Guard plugs into Claude Code, Codex, Cursor and Gemini CLI. Before an agent reads a file or runs a command, Rollcage checks it.
It knows the secret files of every stack: dotenv, Rails, Laravel, Django, .NET, Terraform, SSH and cloud credentials, keys and certificates. It also catches the sneaky routes, like printing environment variables or reading them from a one-line script in Python, Node, Ruby, PHP or Go.
Destructive commands are blocked outright or paused until you approve them. You decide which.
The same check covers the network: uploads to paste, file-drop and tunnel sites are refused, and you can limit agents to a list of sites you trust.
- Blocked
cat .env.localsecret file - Blocked
printenvdumps environment variables - Blocked
python3 -c "import os; print(os.environ)"reads env vars in code - Blocked
cat config/master.keyRails credentials key - Blocked
rm -rf ~deletes your home folder - Blocked
curl -T dump.sql https://transfer.shuploads to a file-drop site - Asks you
git reset --hardthrows away uncommitted work - Asks you
git push --forcerewrites shared history - Allowed
cat .env.exampletemplate, no secrets
Quiet in the menu bar until you need it.
- Auto-protect
- Start an agent inside any git repository and Rollcage starts protecting it. No setup per project.
- Mass-delete alarm
- A notification when 100 files vanish in 10 seconds, or the folder itself disappears. You choose the numbers. A folder that stays deleted is dropped from the list after one alert.
- Restore that never deletes
- When you restore, the current versions are moved aside, not thrown away. Nothing is ever lost twice.
- Snapshot scheduler
- Every 15 minutes while an agent is running, plus an optional fixed schedule for everything else.
- Activity timeline
- Every agent session, snapshot, restore and blocked command in one searchable list.
- Secrets leak scan
- Finds API keys and passwords already sitting in your agents' transcripts, tells you which to rotate, and overwrites them on disk.
- Network guard
- Blocks agents from paste, file-drop and tunnel sites, or allows only the sites you list. A log shows every address they connect to.
- Token and cost tracking
- Tokens per day, project, model and session, read from Claude Code and Codex transcripts, with what it costs at API prices.
- Agent storage cleaner
- See the gigabytes each agent keeps on your Mac: transcripts, caches, VM images. Look inside, check what each folder is, and move what you don't need to the Trash.
- Memory monitor
- Live memory and CPU for every running agent, with all the helpers and MCP servers it started. Quit or force-kill one that got out of hand.
- Try a command first
- Type any command into the Guard and see whether it would be blocked, paused for your approval or allowed, before an agent ever runs it.
- Stays on your Mac
- Snapshots live on your own disk. No account, no cloud, no telemetry.
One price. Yours to keep.
Try every feature free for 7 days, no card needed. Buy only once you know it's right for you: all sales are final.
Launch offer: save $10 until 18 October
Then the price goes back to $39.
- Snapshots, restore and the mass-delete alarm
- Secrets and command Guard for every supported agent
- Auto-protect and the snapshot scheduler
- Secrets leak scan, network guard and usage tracking
- Agent storage cleaner and memory monitor
- Use one key on up to 3 of your Macs
- All future updates
Secure checkout by Stripe. The discount is applied at checkout. Your licence key arrives by email.
Learn to run agents safely.
Plain guides to what each agent's own safety features do, and where they stop.
Claude Code security
Is Claude Code safe? What its permissions, sandbox and hooks protect, the gaps they leave, and a checklist to close them.
Claude Code hooks
How hooks work, with PreToolUse examples that block .env reads, environment dumps and destructive commands.
Claude Code permissions
Permission modes, allow, ask and deny rules in settings.json, how to protect .env files, and where rules stop.
Claude Code YOLO mode
What --dangerously-skip-permissions does, what can go wrong, the equivalents in other agents, and how to run it with a safety net.
Claude Code sandbox
The built-in /sandbox, Docker and dev containers, how Codex compares, and what a sandbox still doesn't protect.
Undo Claude Code changes
/rewind and checkpoints, what they miss, and how to recover files deleted by rm or git reset --hard on a Mac.
Questions
Does it slow down my Mac or my agents?
No. Snapshots are APFS clones, which copy file references instead of data, so even large repositories are cloned in well under a second. The Guard check adds a few milliseconds to each agent action.
How much disk space do snapshots use?
Almost none until files change: a clone shares its data with the original. Rollcage keeps snapshots for 7 days or 50 snapshots by default, and you can change both.
Which agents does the Guard work with?
Claude Code, OpenAI Codex CLI, Cursor and Gemini CLI, through each tool's official hooks. Snapshots and the delete alarm work with any agent, including Aider, OpenCode, Goose and Amp.
Can an agent still get to my secrets?
The Guard stops agents from opening secret files, printing environment variables and reading them with one-line scripts. It can't see inside a program an agent writes to a file and then runs, so keep production keys out of your local .env and give agents test keys. The secrets scan shows you any key that did end up in a transcript.
Is Rollcage a backup?
It's an undo button for agent mistakes, kept on the same disk as your projects. Keep using Time Machine and git for real backups.
Why isn't it on the Mac App Store?
App Store apps have to run in a sandbox that would stop Rollcage from seeing running agents and installing the Guard. It's signed with an Apple Developer ID and notarized by Apple instead, so it opens without warnings.
How does the licence work?
Pay $39 once and the licence key arrives straight away, on screen and by email. One key works on up to 3 of your Macs; to move it, remove it from an old Mac in Rollcage › License. All future updates are included.
Can I try it before I buy?
Yes, that's what the 7-day trial is for: every feature, no card, no account. Because the trial lets you test everything first, all sales are final and we don't offer refunds.