A PreToolUse safety hook stops AI agents before they break rules

The problem this addresses is not malicious AI but helpful AI. Asked to fix a missing package or find a config, an agent may install software system-wide, search the home folder, or call an API to test something — all in good faith, and all capable of breaking a work machine, peeking outside a project, or leaking data.

The author's design splits enforcement into two layers. Rules in a file tell the AI what not to do and how to behave when stopped; the safety hook then inspects the actual tool call before it runs and cancels it if it violates the rules. The hook is written to fail closed: if the checker cannot run or returns nothing, the operation is stopped as a precaution.

The checker sorts tool calls by type — file reads and writes, commands, web access — and matches them against patterns paired with the reason for stopping. That reason is passed back to the AI, which is expected to shift toward asking the user to do the operation instead. Some operations are deliberately allowed, such as pip install inside a project's own virtual environment, to avoid blocking so much that users disable the hook. Web access is restricted to a small self-written MCP server that only issues GET requests, sends no body, strips cookies and auth headers, caps URL and query length, refuses localhost and internal IP addresses, and logs every request. Testing covered 49 decision cases and 11 run cases under the same launch method as Cline, and confirmed fail-closed behavior when guard.mjs was deleted.