How to stop an AI coding agent from running redis-cli flushall

The short answer

Give your AI coding agent a dedicated Redis user bound by an ACL that denies the dangerous command group. In legacy Redis environments without ACLs, rename FLUSHALL and FLUSHDB in redis.conf. For coding agents that run with your developer shell credentials in local or staging environments, install Deedglass’s pre-command shell guard to intercept redis-cli flushall and redis-cli flushdb before the request reaches the server.

What flushall actually destroys

Developers often treat Redis as an ephemeral cache, but modern application stacks store critical operational state in memory:

1. Background job queues. Celery, BullMQ, and Sidekiq hold enqueued tasks, scheduled retries, and rate limit counters in Redis. Running FLUSHALL empties pending jobs without running failure handlers.
2. User sessions and authentication tokens. Distributed web servers store bearer session IDs in Redis. A flush invalidates active sessions, logging out every active user simultaneously.
3. Throttles and circuit breakers. Distributed rate limits prevent upstream services from overload. Clearing Redis resets usage buckets, causing downstream cache stampedes.

When an AI agent runs into an unexpected cache miss during a test run, it frequently tries to “clean the state” by issuing redis-cli flushall or redis-cli flushdb.⁴ Without guardrails, this wipes all databases on the instance.

Why agents reach for flushall in test runs

When autonomous coding agents work on integration test failures or backend debugging tasks, their primary goal is making tests pass. If a test fails because of stale cache data or an unexpected state key leftover from a prior run, the model frequently searches for a quick reset mechanism.

In many developer documentation sites and community forums, redis-cli flushall is recommended as an easy way to reset a local Redis instance. Coding models memorize this pattern. When faced with an unfamiliar test state or a flaky queue worker, an agent will generate commands like redis-cli flushall --async or redis-cli -h 127.0.0.1 -p 6379 flushdb.

If the developer is running a shared local Redis container that also holds session state for running local microservices, background job queues, or simulated customer data, that single command wipes the entire environment in milliseconds.

Layer 1: restrict commands with Redis ACLs

Redis 6 introduced Access Control Lists (ACLs), which allow per-user command and key restrictions.³

Instead of passing the default administrative user password to your AI tooling, create an agent-specific user that can read, write, and inspect keys, but cannot invoke destructive administrative routines:

Code What the screen or file shows, copied as is.

ACL SETUSER agent-worker on >SecretPassphrase123 ~* +@all -@dangerous -@admin

This configuration applies several safety boundaries:

• +@all: grants general command execution.
• -@dangerous: removes administrative commands like FLUSHALL, FLUSHDB, KEYS, RESTORE, and MIGRATE.
• -@admin: blocks reconfiguration routines like CONFIG SET, SHUTDOWN, and DEBUG.

Verify the policy using redis-cli:

Code Commands typed in a terminal. The text around it says what happens.

redis-cli --user agent-worker -a SecretPassphrase123 FLUSHALL
# Output: (error) NOPERM this user has no permissions to run the 'flushall' command

Layer 2: rename or disable destructive commands

If you run an older Redis deployment or share an instance where ACLs cannot be introduced immediately, disable FLUSHALL and FLUSHDB in your redis.conf configuration file:

Code What the screen or file shows, copied as is.

rename-command FLUSHALL ""
rename-command FLUSHDB ""
rename-command SHUTDOWN ""

Setting the replacement string to empty quotes completely unregisters the command from the dispatcher table. Any subsequent call returns:

Code What the screen or file shows, copied as is.

(error) ERR unknown command 'FLUSHALL'

If internal operations scripts still need flushing capabilities, assign a secret unguessable alias:

Code What the screen or file shows, copied as is.

rename-command FLUSHALL "SECURE_OPS_FLUSH_a982f1"

Layer 3: pre-command guard for coding agents

Database ACLs protect the server when the agent connects using its own credentials. But coding agents like Claude Code, Cursor, and Windsurf often run inside the developer’s workstation terminal, where local environment variables give the agent full administrative access to local and staging databases.⁴

Deedglass provides a pre-command shell guard that inspects bash commands before execution.⁴ When an agent attempts to execute destructive database operations, the hook interrupts the process and requests human authorization:

Code Commands typed in a terminal. The text around it says what happens.

npx deedglass protect

This command configures local agent hook files across Claude Code, Cursor, Codex CLI, Gemini CLI, and Copilot CLI.⁴

When an agent issues redis-cli flushall or redis-cli -h staging.internal flushdb, the guard catches the command signature and stops:

Code What the screen or file shows, copied as is.

[deedglass] Ask: deletes every key in Redis, so its data and cached state are gone

The shell guard operates locally on the machine without network roundtrips, accounts, or telemetry.⁴ For headless automated environments, setting --deny halts destructive actions automatically.

How the shell guard intercepts destructive patterns

The shell guard evaluates bash command strings by tokenizing command words, options, and pipelines before the shell spawns the subshell process.⁴ When inspecting Redis operations, it checks for program invocations matching redis-cli paired with destructive subcommands flushall or flushdb.

Because developers often execute commands inside containers, the guard also parses container wrapping patterns such as:

Code Commands typed in a terminal. The text around it says what happens.

docker compose exec redis redis-cli flushall
docker exec -it app-redis redis-cli -p 6379 flushdb

In all these variations, Deedglass extracts the inner command tokens and triggers an interactive authorization prompt before the command reaches the container daemon. If the user denies the operation, the agent receives an exit code 2 blocking signal with a clear explanation: "deletes every key in Redis, so its data and cached state are gone".⁴

If the shell guard encounters commands nested deeper than 12 levels or command buffers larger than 1 MiB that cannot be safely read, it defaults to asking rather than allowing the action through unchecked.⁴ If the hook binary is unavailable on the machine, the command passes normally to prevent broken workstation environments.⁴

A checklist for agent Redis access

Follow this checklist before connecting autonomous coding agents to environments with running Redis instances:

• Isolated instance: Never point an agent at production Redis instances without isolated key namespaces and separate ports.
• Dedicated ACL: Create a restricted agent-worker user denying -@dangerous and -@admin.
• Pre-command hook: Install npx deedglass protect on agent workstations to catch shell commands before they run.⁴
• Disable root commands: Set rename-command FLUSHALL "" in development configurations where ACLs are unavailable.
• Audit trail: Monitor query logs and review sealed records to identify which tools and scripts triggered administrative requests.

To see the guard’s evaluation for a specific command without executing it, run npx deedglass guard shell --no-files --command 'redis-cli flushall'. To grade what local tools and credentials an agent can reach on your own workstation, run npx deedglass scan (what the grade means). To test policy rules in an interactive sandbox without installing software, open the playground.

Written with AI assistance and checked against our claims register.