Sponsio plugin
Sponsio checks every agent tool call against deterministic rules before it runs and blocks risky actions without calling a model
- 454 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Intercepts every agent tool call and can block, warn or queue it according to its own rules
- The Claude Code plugin writes hooks into project settings and a contract tree into the user's home directory
Install
- Works in
Manual install
pip install --pre sponsioAlpha-version Python package; npm install -D @sponsio/sdk@alpha covers TypeScript.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Intercepts every agent tool call and can block, warn or queue it according to its own rules
- The Claude Code plugin writes hooks into project settings and a contract tree into the user's home directory
This is third-party code. Review the repository files before installing.
What it does
Sponsio installs with pip install --pre sponsio or npm install -D @sponsio/sdk@alpha and wires into an agent through sponsio init: the wizard detects the framework, writes sponsio.yaml in observe mode and prints a ready wrap snippet. A contract states an expectation and a requirement for a specific tool call, for example "a single wire transfer stays under 50000" or "compliance_approve must run before wire_transfer." Checking one contract takes about 0.0052 ms by the project's own numbers and calls no model. For Claude Code there is a separate sponsio-claude-code plugin with a .claude-plugin/plugin.json: after /plugin install sponsio-claude-code, the configure skill walks through setup, bootstraps a contract-library tree at ~/.sponsio/plugins/, installs starter rule sets for popular MCP servers such as github and filesystem, runs sponsio plugin scan to generate rules for MCP servers without a bundled starter, and tunes sensitivity to the user's own environment. 22 ready-made rule bundles, from capability/destructive to capability/shell, drop into sponsio.yaml with one line each. sponsio demo --scenario wire replays a recorded case out of the box where an agent tries to wire $847,000 to an unverified vendor, and shows Sponsio blocking the transfer on two rules at once. The app.sponsio.dev hosted console is only for watching run history and drafting rules together; the enforcement itself runs without it and without an account.
Who it is for. For developers who let an agent run commands, move money or touch files through LangChain, the Claude Agent SDK, CrewAI or MCP, and want a specific risky action stopped before it runs.
Good fit when
- A finance-bot agent could wire an amount over the limit without compliance sign-off, and that needs blocking by a rule rather than a prompt reminder
- You want to protect Claude Code with the ready-made sponsio-claude-code plugin and set it up through the configure skill in one pass
- The agent talks to MCP servers with no bundled rule set yet, and sponsio plugin scan should generate starter contracts for them
- You want to confirm a rule actually fires before it goes live: sponsio demo replays prebuilt risky scenarios
- A team wants a shared rule draft reviewed by a person before it arms: sponsio push sends the draft and sponsio pull brings back the approved version
Not a fit when
- You need protection against a text injection in the prompt itself before any tool call: Sponsio checks the tool call, not the model's reply content
- Rules must be written and checked purely in natural language with no look at the final contract: sponsio validate gives a draft that still needs review before it is enforced
- You want a cloud agent with no local install: enforcement always runs as a local process next to the agent, the hosted console is only for history and shared drafts
- The project needs a stable library release and cannot take an alpha: the sponsio and @sponsio/sdk packages are currently marked pre and alpha
Example request
Install Sponsio for this LangChain agent, turn on the capability/destructive rule bundle, and show on the wire demo scenario that the risky transfer gets blockedLimitations
The current version v0.2.0a19 is marked alpha, and the developer calls the package a pre-release outright. Ready integrations cover LangChain, Claude Agent, OpenAI Agents, Google ADK, CrewAI, Vercel AI, MCP and a custom Python or TypeScript tool-calling loop; other stacks need manual wiring per the integration docs. The app.sponsio.dev console accepts uploads on a best-effort basis: if it is down, the agent keeps running, but run history delivery is not guaranteed either. sponsio validate turns a plain-English rule into a contract as a draft for human review, not a production-ready rule on its own.
How to disable. Delete or rename sponsio.yaml and remove the guard wrap line from the agent's code. For the Claude Code plugin, run /plugin uninstall sponsio-claude-code, and delete the contract tree at ~/.sponsio/plugins/ by hand if it is no longer needed.
FAQ
How do I install Sponsio for Claude Code?
Run /plugin install sponsio-claude-code, then invoke that plugin's configure skill: it bootstraps a contract-library tree at ~/.sponsio/plugins/ and installs starter rules for popular MCP servers.
Does checking a rule need a model call?
No. A contract is a deterministic rule; by the developer's own numbers, checking one contract takes about 0.0052 ms and calls no LLM.
How is Sponsio different from HOL Guard?
Sponsio checks a call against named contracts with ordering and value-range conditions, such as a transfer amount and a required prior approval, while HOL Guard looks for risky command and package patterns without that level of contract language.
How do I write a rule in plain language?
sponsio validate with a quoted phrase turns it into a contract that still needs reading and adjustment before enforcement: Sponsio's determinism is in runtime checking, not in drafting the rule.
What does app.sponsio.dev do?
The hosted console shows run history and lets a team keep a rule draft for human review before it is enforced. Uploads there are best effort and never block the agent if the console is down.
Discussion
No questions or reviews yet.
Related
PluginsAgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
A plugin that checks the commands, URLs and file writes an AI agent attempts and blocks the dangerous ones before they run
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Sponsio (this entry) | yes | 454 | |
| HOL Guard | yes | 1,012 | named contracts with ordering and value-range conditions across frameworks, not command-pattern checks limited to coding agents |
| Agent Safehouse | no | 2,125 | a deterministic, model-free check on each tool call, not a separate sandbox for running the agent |
README in short
The README compares contract-check speed to an LLM judge, over 5,000 times faster by its own measurements, and links to a separate document with its ODCV-Bench and RedCode-Exec benchmark methodology. It continues with a two-path quick start, pasting a ready prompt into the agent or installing the CLI, then a section on the hosted console for watching runs and drafting rules, and a catalog of 22 ready contract bundles linking to the 48 underlying patterns they are built from.