Agent Governance Toolkit plugin
Agent Governance Toolkit (Claude Code plugin)
A Microsoft plugin for Claude Code whose hooks inspect prompts and tool calls against a policy and block dangerous commands.
- 6,562 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Hooks run on every prompt and tool call and can block legitimate work on a false positive.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/agent-governance-toolkit-claude-code-pluginDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Hooks run on every prompt and tool call and can block legitimate work on a false positive.
This is third-party code. Review the repository files before installing.
What it does
Agent Governance Toolkit is a Microsoft suite for governing autonomous AI agents: policies, identity, sandboxing, audit. For Claude Code the repository ships an `agt-governance` plugin in the `agent-governance-claude-code` folder. The plugin attaches three hooks: `SessionStart` injects the rule context into the session, `UserPromptSubmit` inspects the prompt and blocks it on suspected injection, `PreToolUse` parses a tool call and answers with allow, deny or ask. The built-in `recursive-delete` rule denies `rm` with both recursive and force flags. A bundled MCP server adds the `agt_policy_status` and `agt_policy_check_text` tools, and the `/agt-governance:agt-status` and `/agt-governance:agt-check` commands call them from chat.
Who it is for. Security teams and developers who run Claude Code on production repositories and want deterministic control on top of prompt-level instructions.
Good fit when
- Claude Code works in a repository with live configuration, and destructive commands such as `rm -rf` must be stopped before they run.
- A team wants suspicious text from external files checked by an injection detector and not only by the model's caution.
- Rules are kept in a config and versioned instead of being repeated in every system prompt.
- An auditor asks for a log of decisions on tool calls.
Not a fit when
- Protection is needed in Copilot CLI or another client: this package targets Claude Code only.
- Full process isolation is expected: hooks inspect commands but are not a sandbox.
- Guaranteed redaction of tool output after execution is required.
Example request
Run `/agt-governance:agt-check` on this text from a third-party package README and say whether it contains an injection attempt.Limitations
The package is described as an experimental parity layer with Copilot CLI and does not claim full feature parity. `PostToolUse` in Claude cannot reliably redact the output of a tool that has already run. The `rm` parser is a bounded tokenizer: it does not resolve variable or brace expansion, `eval`, `sh -c`, or deletion through `find` and `xargs`. The `/agt-governance:agt-status` and `/agt-governance:agt-check` commands are thin wrappers over MCP tools, not deterministic code.
How to disable. Run `/plugin uninstall agt-governance@agent-governance-toolkit` and restart the session. The plugin's hooks and MCP server go away with it.
FAQ
What does the plugin do with a suspicious prompt?
It blocks the prompt: the `UserPromptSubmit` check fails closed. The user sees a refusal and can rephrase the request.
Can the plugin run without a marketplace?
Yes, for a local trial: `claude --plugin-dir ./agent-governance-claude-code` from a cloned repository.
Where are the rules stored?
The default policy lives in `config/default-policy.json` inside the plugin. Explicit user patterns apply alongside the built-in `recursive-delete` rule.
Does the plugin need Python?
No. It is built on the TypeScript SDK and runs hooks through Node. The Python stack is needed only for the other Agent Governance Toolkit components.
Which commands does the plugin add?
`/agt-governance:agt-status` shows the policy state, and `/agt-governance:agt-check` checks supplied text with detectors for injection, context poisoning and MCP threats.
Discussion
No questions or reviews yet.
Related
PluginsA marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
A Claude Code plugin that screens prompts, tool calls and documents for injection and leaks, returning BLOCK, CHALLENGE or ALLOW
A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
A Claude Code plugin that classifies each tool call and the agent's reasoning, then blocks risky ones or asks you first.
AgentGuard checks a coding agent's actions before they run and scans third-party skills for secrets, backdoors and injections.
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
README in short
The package is described as an initial governance layer for Claude Code built on hooks and a bundled MCP server. The wider repository covers five SDK languages and the OWASP Agentic Top 10.