Permit0 CLI
A policy engine for AI agent actions: a Claude Code hook scores each call before it runs, then allows, blocks or waits for you
- 192 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Adds a PreToolUse hook to Claude Code settings: the engine sees the parameters of every tool call, including email bodies
- The daemon with a dashboard on port 9090 and a Postgres database stores decision history and an ed25519 signing key
- With unknown set to allow or bypass, calls without a rule pack pass through, so protection depends on configuration
Install
- Works in
Manual install
git clone https://github.com/permit0-ai/permit0.gitThen in the project folder: docker compose up -d --build. The dashboard opens on port 9090. A source build is described in docs/installation.md and needs Rust 1.85 or newer.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Adds a PreToolUse hook to Claude Code settings: the engine sees the parameters of every tool call, including email bodies
- The daemon with a dashboard on port 9090 and a Postgres database stores decision history and an ed25519 signing key
- With unknown set to allow or bypass, calls without a rule pack pass through, so protection depends on configuration
This is third-party code. Review the repository files before installing.
What it does
Permit0 sits between the model's decision and the action running. Every tool call is normalized to a canonical action such as email.send or payment.transfer, scored deterministically on 9 risk flags and 7 amplifiers, and then the engine allows it, blocks it or sends it to a human. Scoring runs in-process in fractions of a millisecond with no network calls, and the same input always gives the same answer. It connects to Claude Code through a PreToolUse hook: the permit0 hook command goes into ~/.claude/settings.json, while the daemon address and approval mode live in ~/.permit0/config.yaml. Calls waiting for a decision appear in the Approvals tab of the dashboard on port 9090. For OpenClaw there is a permit0Skill wrapper that routes every skill dispatch through the same daemon. The --shadow mode only logs decisions and blocks nothing, which is handy for watching first. An action that cannot be mapped to a known shape does not run on its own: it goes to the approval queue. Every decision lands in a log signed with ed25519 and chained by hashes. Version 0.1 ships one rule pack, for Gmail and Outlook email; packs are written in YAML and you can write your own in an afternoon.
Who it is for. People who give Claude Code or OpenClaw access to email, databases and payments and want hard rules that fire before the action, not after.
Good fit when
- The agent reads mail through Gmail or Outlook and outbound messages must pass your approval
- You need reproducible scoring of action risk and a signed decision log for audits
- You are writing your own rule pack for Slack, Notion or Stripe and want a shared action vocabulary
- Before turning blocking on it is worth watching the agent for a week in --shadow mode
- The agent is kept away from real work because Claude Code has no hard permission that is guaranteed to be enforced
Not a fit when
- The danger is in the reply text, such as made-up advice: without a tool call there is nothing to intercept
- The agent's tool does not pass through the permit0 hook or gateway: the engine cannot see those calls
- You need a ready binary in one command: for now the engine builds from Rust source or runs through Docker
- Your tool has no rule pack and nobody to write one: actions without a pack pile up in the approval queue
Example request
Connect Permit0 to Claude Code in --shadow mode and show on the dashboard which email calls it would have flagged as riskyLimitations
- One rule pack is ready, for email (Gmail and Outlook). Packs for Slack, Notion, Linear, Stripe, Postgres, Bash and GitHub are on the roadmap. Calls without a pack go to manual approval by default.
- There are no prebuilt binaries: you need Rust 1.85 or newer, or Docker. The hook binary is copied out of the image by hand.
- The engine sees only calls that pass through the permit0 hook or gateway. Subprocesses with their own network requests and tools outside the agent framework stay invisible.
- This is version 0.1 and the last commit in the repository is dated June 2026. Integrations exist only for Claude Code and OpenClaw.
How to disable. Remove the PreToolUse block with the permit0 hook command from ~/.claude/settings.json and stop the containers with docker compose down in the project folder. The ~/.permit0/config.yaml file can be deleted.
FAQ
How is Permit0 different from OPA or Cedar?
OPA and Cedar are policy languages, while Permit0 is a ready engine. It intercepts the call, maps it to a canonical action and scores the risk. Version 0.1 ships a vocabulary of 22 domains and 159 action verbs.
How do I connect Permit0 to Claude Code?
Add a PreToolUse hook with the permit0 hook command to ~/.claude/settings.json and set the daemon address in ~/.permit0/config.yaml. Decisions on risky calls then show up in the Approvals tab of the dashboard on port 9090.
What happens to a tool that has no rules?
It does not run silently. An unknown action goes to manual approval. The unknown parameter in config.yaml changes the behavior: bypass, ask, allow or deny.
Can I observe first without blocking anything?
Yes. permit0 hook --shadow or the PERMIT0_SHADOW=1 variable writes decisions to the log but does not stop calls.
Does the engine need internet access?
No. SQLite and memory are enough by default, and deterministic scoring makes no network calls. Review of ambiguous cases by a language model is optional and can be switched off.
Discussion
No questions or reviews yet.
Related
CLI toolsA plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
An execution firewall for agent actions: decides ALLOW, DENY or ESCALATE and writes a signed receipt that can be verified later.
A guard on an AI agent's execution path: every tool call gets a PASS, AUTH or BLOCK verdict before it runs
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
An authorization engine for agents: every action gets allow, deny, human_review or compute, with each decision logged
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Permit0 (this card) | no | 192 | |
| HOL Guard | yes | 1,094 | checks commands and packages across several agents, while Permit0 has its own action vocabulary and 9-flag risk scoring |
| CC Safety Net | no | 2,014 | blocks only destructive Git and file system commands, with no risk scoring of emails or payments |
README in short
The README opens with a promise of a hard boundary between the model's decision and the action, then walks through a five-minute Claude Code setup with Gmail and Outlook. It continues with a comparison to Microsoft AGT, Lakera and Langfuse, the action vocabulary, an eight-step pipeline diagram and a limitations section. It closes with how to write your own rule pack.