AI-agent tool policy

Rules an AI agent cannot talk its way past

Warrant MCP compiles plain-English policy once and uses deterministic code to check supported tool calls. A Claude Code hook turns DENY into a hard block where that integration applies.

Open installation and quickstart All Products

Maturity

Current maturity: an open-source TypeScript reference implementation, a versioned policy specification and Claude Code enforcement. Other MCP hosts receive an advisory check tool, not binding enforcement.

Approval prompts and agent judgement leave a gap

A person should not have to approve every tool call, and the agent should not be the authority that decides whether its own action is permitted. A closed policy vocabulary provides a narrower, testable boundary.

Sixty-second path

Initialization installs a reviewed example policy without an API key. Policy review is the only command that compiles and the only one that needs an Anthropic API key.

npm install -g warrant-mcp
cd your-project
warrant-mcp init
warrant-mcp test "delete .env"

Open installation and quickstart

Policy lifecycle

Write

State rules in plain English.

Review

Compile once, inspect clauses and compare behaviour.

Accept

Adopt the reviewed artifact.

Check

Evaluate a supported action against closed structured rules.

Enforce

The Claude Code hook blocks DENY before the tool executes.

Report

Render the local decision record as a self-contained HTML report.

A closed, specified rule vocabulary

SPEC.md version 0.1.0 defines eight rule types, precedence, fail-closed behaviour and deliberate limits. A 76-case language-agnostic corpus checks the reference implementation against that contract.

File deletion outside a workspace or against protected paths

File writes constrained to named scopes

Forbidden shell tokens, sequences and invocations

HTTP host and method allowlists

Read the policy specification

Verified in the repository

Warrant MCP specification 0.1.0 defines eight rule types, precedence, fail-closed requirements and deliberate limits. Its TypeScript reference implementation runs a 76-case language-agnostic conformance corpus.

Verified · CL-45

Warrant MCP binding enforcement is limited to its Claude Code hook. Other MCP hosts can call check_action for an advisory ALLOW or DENY, but the tool cannot force the host to comply.

Verified · CL-46

Warrant MCP writes a local plain-text decision record and can render it as a self-contained offline HTML report. The record is append-only by convention, has no integrity check, and is evidence rather than proof.

Verified · CL-47

Supported enforcement model

Claude Code PreToolUse is the binding integration. The check_action MCP tool returns advice for other hosts; it cannot force a host to comply.

Local record and report

Checked tool calls append to a local JSONL record. The report command renders a self-contained offline HTML view and screens output for credential shapes and machine identity before writing.

Limitations are part of the product

This is a policy layer, not a sandbox.

Binding enforcement currently applies to Claude Code tool calls only.

Shell expansion, obfuscation, symlinks, implicit targets, unmapped tools and time-of-check/time-of-use gaps remain open classes.

Hook configuration remains editable unless organization-managed settings protect it.

The local record is append-only by convention, has no integrity check and is evidence rather than proof.

Read the security surface

Test a policy boundary with the reference implementation

Teams evaluating deterministic tool policy can open a public GitHub issue with the host, action types and failure boundary they need to test.

Start a public product conversation

Add policy checks to your MCP toolchain

Install the server, run a first check, and keep the record.

Open installation and quickstart Contact Us