One bad PowerShell command
can delete everything.
Terminal Guardian evaluates every command before it executes — and stops the ones that shouldn't run.
Local-first enforcement. No ML guesswork. No subscription. A policy-based safety layer for PowerShell 7+ on Windows — active before your finger leaves the Enter key.
pwsh) required
|
● Local-first enforcement — no cloud dependency
|
● One-time payment — no subscription
|
● Delivered via Gumroad
What happens with one wrong command?
PowerShell is powerful by design. That's the problem. A single command can wipe directories, overwrite configs, or expose credentials — and undo is not always an option.
Destructive delete
Remove-Item C:\Prod\* -Recurse -Force — a single paste from an AI assistant, a tab-complete gone wrong, or a script targeting the wrong path. Gone.
Copy-paste from the browser
You copy a command from Stack Overflow or a blog post. You don't read the full flags. Or the page was modified. Paste-and-run is one of the most common sources of terminal accidents.
AI-generated commands
ChatGPT and Copilot generate plausible-looking PowerShell. They also hallucinate flags, target wrong paths, and omit safety qualifiers. Running AI output without a guardrail is a production risk.
Disk wipe and volume operations
Format-Volume, Clear-Disk, diskpart. These commands have irreversible effects. When run under automation or elevated sessions, the damage is instant and total.
Credential exposure in logs
Passwords, tokens, and API keys passed inline in commands end up in history files, audit logs, and CI outputs. Without redaction, sensitive data lives in your terminal trail.
Admin mistakes under pressure
Incident response, late-night deployments, rushed rollbacks. When you're moving fast in an elevated session, the probability of a catastrophic command is highest exactly when you can least afford it.
What Terminal Guardian helps stop
Every command is evaluated against your active policy before execution. Not after. Not in a log you review later. Before.
Destructive deletes
Remove-Item with -Recurse -Force, recursive wipes, disk-clearing operations — blocked by default. Your production directories don't get deleted because a policy rule fires before the shell does.
Dangerous copy-paste
Commands pasted from browsers, docs, or chat tools are evaluated the same as any other command. If the pasted content triggers a policy rule, it gets challenged or blocked before execution.
Risky AI-generated commands
You use AI tools to write PowerShell. That's fine. Terminal Guardian acts as the safety layer between what the AI suggested and what your machine actually executes. Run AI output with a guardrail, not on faith.
Costly admin mistakes
Registry edits, service kills, database operations — challenged or blocked depending on your policy. The confirmation step isn't friction. It's the 2-second pause that separates an incident from a near-miss.
How it works
Terminal Guardian hooks into your PowerShell session and intercepts every command before execution. No ML. No heuristics. Rules-based policy that returns one of four deterministic outcomes.
Command clears policy.
Execution proceeds normally. Nothing visible to the user. Zero friction.
Elevated risk detected.
Execution continues but a visible warning is displayed and logged to the audit trail.
Confirmation required.
Execution pauses. Explicit confirmation needed. Outcome is logged either way.
Command halted.
Execution stopped. Policy rule name and actor logged to audit trail. Nothing runs.
Policy + Audit in one view
Active policy packs define what gets blocked, challenged, or allowed. Every event — with redacted secrets — is captured in a searchable audit trail. SHA-256 integrity verification confirms your policy hasn't been tampered with.
- SHA-256 policy manifest integrity verification
- Secret redaction on all log output
- Destructive command guardrails active by default
- Dry-run mode to preview policy outcome before execution
- Full governance trail for incident forensics
Active Policy Pack
✓ SHA-256 manifest verified
Recent Audit Events
Compliance Summary
– Full event trail retained
– Secret redaction enabled
– Enforcement mode: strict
See the block in action
Watch Terminal Guardian intercept a destructive command in real time — before a single file is touched.
Why you can trust it
A safety tool has to be trustworthy by design. Here is what Terminal Guardian is — and what it explicitly is not.
Local-first
Core enforcement runs entirely on your machine. No behavioral telemetry is sent anywhere. No cloud dependency for enforcement to function.
Deterministic
No machine learning. No scoring that shifts over time. The same command against the same policy produces the same outcome. Always.
Auditable
Every command evaluation is logged — outcome, policy rule, actor, redacted secrets. You can answer "what ran, when, under which policy, with what result" after any incident.
Honest scope
It governs the PowerShell session it is loaded into. It is not antivirus, not EDR, not a backup system. It does exactly what it claims — no more.
Scope note — read this
Terminal Guardian is a guardrail, not a vault.
It governs the PowerShell workflow it is loaded into. It is not antivirus, EDR, or a replacement for backups, endpoint controls, or change-review process. It does not protect other shells, WSL, or non-PowerShell processes. If you need one of those things, this is not that product.
Full trust model and non-scope →Who uses Terminal Guardian
If you run PowerShell on Windows and mistakes have consequences, this is built for you.
Individual user
PowerShell developers
You write scripts daily. You work in production directories. You use AI tools to generate commands faster. One mistake at the wrong time costs hours of recovery work — or worse.
Operations
IT admins
You manage multiple machines and need consistent, enforceable behavior. You want a policy layer that documents what happened during every admin session — without standing over every user.
Infrastructure
DevOps & infra engineers
You work with production environments. Elevated sessions, build agents, rollback scripts. The cost of a wrong command is a P1 incident. A guardrail running in the session before execution is exactly the right tool.
Security
Security-conscious teams
You need an audit trail. You need policy enforcement. You need to be able to show, after an incident, exactly what commands ran and what was blocked. Terminal Guardian gives you that for the PowerShell layer.
AI-assisted workflows
AI command users
You use ChatGPT, Copilot, or Claude to generate PowerShell. That's now normal. Terminal Guardian is the safety layer between what the AI suggests and what your machine executes. Use AI — just don't run it blind.
Service providers
MSP owners
You run PowerShell scripts across client machines. One technician running the wrong script on the wrong client environment is a liability. Policy enforcement and audit trails belong in your stack. Ask about team and MSP options →
Setup in under 2 minutes
Download from Gumroad, run one script, open a new pwsh window. Done.
-
1
Buy and download the ZIP from Gumroad.
One-time purchase. No GitHub account required.
-
2
Extract the ZIP to any folder.
-
3
Run
setup.cmdand close all PowerShell windows. -
4
Open a new
pwshwindow and run:tg selftestAll checks passing = clean install, enforcement active.
Simple, one-time pricing
No subscription. No renewal. Pay once, own it.
The math is straightforward.
A single production recovery incident — restoring deleted files, rolling back a bad script, tracing what ran — typically costs 4–8 hours of engineering time. At an average loaded rate, that's $600–$2,000 per incident. Terminal Guardian Personal is $49, once. The first blocked command pays for it.
Personal
one-time • 1 machine
- Full policy engine
- Default policy packs
- Audit trail
- Local-first enforcement
- tg selftest validation
Pro
one-time • up to 3 machines
- Everything in Personal
- Custom policy packs
- Log export tools
- Zero-trust policy template
- Priority email support
Team
one-time • up to 25 seats
- Everything in Pro
- Team policy management
- Centralized audit review
- Deployment guidance
- Coming soon
MSP / Enterprise
volume • contact us
- Unlimited seat licensing
- Custom policy engineering
- Dedicated support
- Volume pricing
- SLA options
All tiers: Windows only • PowerShell 7+ only • One-time payment • No subscription
Frequently asked questions
No. Terminal Guardian requires PowerShell 7+ (pwsh). It does not support Windows PowerShell 5.1. If your environment runs only 5.1, you need to upgrade to pwsh first.
No. Terminal Guardian is a command guardrail. It evaluates PowerShell commands before execution based on policy rules. It does not scan files, monitor processes, detect malware, or replace endpoint security tools. Use it alongside your existing security stack — it handles the PowerShell execution layer specifically.
Core enforcement is entirely local. No commands or audit data are sent to external servers during normal operation. The tg selftest command performs a cloud-verified integrity check to validate the install — that is the only network call, and it is optional. You can see the full trust model at trust-model.html.
Terminal Guardian governs the PowerShell session it is loaded into. If someone opens a new PowerShell session outside your profile, or uses another shell entirely (cmd, bash, WSL), enforcement does not apply. It is a guardrail for deliberate workflows — not a hard security boundary for a hostile actor with local access. We say this clearly because honesty about scope is part of the trust model.
Yes. Terminal Guardian intercepts every command in the session regardless of source — typed by hand, pasted from a browser, or generated by an AI tool. If you paste a ChatGPT-generated command that matches a block rule, it is blocked. The source of the command is irrelevant to the policy engine.
Not currently. Gumroad provides a refund window if you purchase and find it is not what you expected. Contact [email protected] with any pre-purchase questions.
No. Terminal Guardian is Windows-only in its current release. If you are interested in macOS or Linux support, use the form below to register interest — that helps determine priority for future platform expansion.
Stop the next bad command
before it runs.
Available now on Gumroad. One-time purchase. Download, run tg selftest, and enforcement is active.
v2.3.3 • Windows • PowerShell 7+ only • No subscription
Not on Windows? Interested in team licensing?
Leave your email and we'll notify you when Linux support or team features ship. No spam. Unsubscribe anytime.
Your email client should be opening.
Complete and send the message to join the waitlist. If your email client didn't open, email [email protected] directly with subject Waitlist Interest.