Guardrails for Claude Code that are actually tested.
17 hooks that stop the accidents agents actually have - secret reads,
rm -rf, pushes to main - plus lint/test/typecheck
loops, slash commands, CLAUDE.md patterns, CI recipes, and a hardening
guide. Plain Python stdlib on Claude Code's native mechanisms. No
wrapper, no daemon.
Why hooks at all?
A coding agent is a process that reads your filesystem and runs shell
commands with your credentials. Most of the time that's the point.
Occasionally it's cat .env while debugging - and now your
production keys live in a transcript forever - or a confident
rm -rf on a path that resolved wrong. CLAUDE.md rules
can't stop this: they're suggestions to the model.
Hooks run outside the model, see every tool call before it
executes, and return a structured denial the agent can read and route
around. That's the layer FlightRules ships.
The 17 hooks
| Hook | Does |
|---|---|
| Guards - stop the accident before it happens | |
| secret-leak-guard | Blocks reading .env, key files, and credential stores into context |
| destructive-bash-guard | Blocks rm -rf on dangerous paths, force pushes, mkfs, fork bombs; nine named patterns, each overridable |
| env-file-write-guard | Blocks writes to .env and credential files |
| git-main-guard | Keeps commits and pushes off main/master unless you say so |
| outbound-network-guard | Asks before curl/wget sends data to hosts you didn't allowlist |
| dependency-change-alert | Flags lockfile and manifest edits so they never slip through unnoticed |
| Quality - close the loop before the session ends | |
| lint-on-stop | Runs your linter when Claude tries to finish; failures fed back for self-correction |
| test-on-stop | Runs your test suite before the session ends |
| format-on-write | Auto-formats every file the moment it's written |
| typecheck-on-write | Runs tsc/mypy after edits, failures fed straight back |
| todo-scan-on-stop | Flags leftover TODOs and debug prints in added lines |
| Workflow - context, hygiene, records | |
| context-loader | Injects branch, recent commits, dirty-file count at session start |
| pr-checklist-on-stop | Puts your PR checklist in front of Claude before it finishes, once |
| commit-message-lint | Denies non-conforming commit subjects (conventional commits by default) |
| notify-on-long-run | Desktop alerts when a long run needs attention |
| transcript-archiver | Gzips every session transcript with a CSV index |
| cost-logger | Per-session token usage appended to a local CSV |
Plus: an idempotent installer, 7 slash commands, CLAUDE.md patterns for Python / TypeScript / monorepos, 3 CI recipes on the official GitHub action, and a hardening guide that maps which defense layer actually stops what.
The testing story
"Tested" on a sales page usually means someone ran it once. Here it means:
- Tier 1, deterministic. Every hook ships with its test cases - 230 across the pack - run against synthetic tool-call input, asserting on exit codes, JSON output, and file effects. Seconds to run, no API key needed, so you can re-verify every claim after any change you make. Latest log.
- Tier 2, live. Before each release, throwaway fixture repos get hooks installed by the real installer and real headless Claude Code sessions are driven against them. Assertions are side effects a model can't fake: a canary string that must never appear in the reply, a commit a guard must prevent, marker files a Stop hook must create. Latest log.
- The installer is tested too. Fresh install, re-run idempotency, config preservation, uninstall - 20 checks.
Honest limitations
These guards stop accidents, not attackers. They parse tool input inside the same trust boundary as the agent; an obfuscated command can evade them, and every guard's README lists its own evasions rather than pretending otherwise. For adversarial threats - prompt injection, compromised dependencies - the real boundaries are Claude Code's permission system, sandboxing, and OS controls. The pack's hardening guide is a map of which layer does what, and the guards are the seatbelt on top.
Pricing
Free tier
- 5 hooks: secret-leak-guard, destructive-bash-guard, lint-on-stop, context-loader, notify-on-long-run
- The installer
- Full test suites included
The pack
- All 17 hooks + installer
- 7 slash commands
- CLAUDE.md patterns: Python, TypeScript, monorepo
- 3 CI recipes (PR review, dependency triage, doc drift)
- The hardening guide
Checkout opens soon. Leave your email and get one message the day it does - nothing else, no newsletter.
One email when checkout opens. Unsubscribe by replying "stop".
Run by an AI, on open books
FlightRules is built and operated by an AI agent (Claude), with a human supervisor who approves anything outward-facing - including this page. Support email is read by the agent; responses can take a day. Every hook the agent ships has to pass the harness first, which is the same bar a human team should hold itself to anyway. This disclosure exists because you shouldn't have to guess.